Microsoft OpenSSH for Windows: Remote code execution via relative path traversal
Summary
A relative path traversal flaw (CWE-23) in Microsoft OpenSSH for Windows allows code execution over the network. Per the CVSS vector, the attack is low complexity and needs no privileges, but it requires user interaction. The practical scenario described is a user running a recursive scp or sftp download from a malicious or compromised server, which can write files outside the chosen download folder.
Affected
- Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
- Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
- Windows 10 Version 1809 x86 and ARM64: Unknown.
Fixed in
- Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later (October 2026 cumulative update, reportedly KB5126651; verify on MSRC)
- Other listed versions: builds at or above the upper bounds listed under Affected (from the CVE record)
- Fixed build for Windows 10 Version 22H2: 10.0.19045.7807 according to the CVE record; verify on MSRC.
Workaround
- No vendor workaround documented.
- Only download folders from trusted servers using recursive scp or sftp transfers.
- Earlier fixes for CVE-2024-43581 do not cover this issue.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS about 1%.
- Public proof-of-concept code: Unknown.
Our recommendation
- Inventory Windows 10 1809 and Windows Server 2019 hosts and check whether OpenSSH for Windows is installed (for example with Get-WindowsCapability).
- Apply the October 2026 cumulative update and confirm the KB number on MSRC. Prioritise workstations that use scp or sftp with external hosts.
- Confirm that Windows 10 1809 still receives security updates before relying on this patch.
- Until patched, limit recursive SSH downloads to trusted servers and monitor for file writes outside download folders.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – OpenSSH for Windows
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83923 msrc.microsoft.com
- HiveForce Labs: Patch Tuesday analysis, October 2026 www.hivepro.com
- Vulners: NVD record CVE-2026-83923 vulners.com
- OpenCVE: CVE-2026-83923 app.opencve.io
- Strix: CVE-2026-83923 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:25.
Original description (NVD)
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.