CVE-2026-59996 & CVE-2026-60002: Fedora 44 OpenSSH Vulnerabilities — Detection and Remediation

---
title: Potential SCP Remote-to-Remote Copy Operation
id: 8a4d2e10-1b9c-4f3d-9c5a-6d7e8f9a0b1c
status: experimental
description: Detects scp command lines indicating a remote-to-remote copy (host-to-host via local), which is the affected vector for CVE-2026-59996. Requires logs with command-line logging enabled.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-openssh-2026-c9d8542bb3
author: Security Arsenal
date: 2026/04/20
tags:
  - attack.initial_access
  - attack.execution
  - cve-2026-59996
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/scp'
    CommandLine|contains: '@'
    CommandLine|re: '.*@.*:.*@.*:.*'
  condition: selection
falsepositives:
  - Legitimate administrative file transfers between servers
level: medium
---
title: OpenSSH Daemon Crash (SIGSEGV)
id: 9b5e3f21-2c0d-5e4e-0d6b-7e8f0a1b2c3d
status: experimental
description: Detects segmentation faults in the sshd daemon, which may indicate exploitation attempts against CVE-2026-60002 (Use-After-Free) or other memory corruption bugs.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-openssh-2026-c9d8542bb3
author: Security Arsenal
date: 2026/04/20
tags:
  - attack.impact
  - attack.denial_of_service
  - cve-2026-60002
logsource:
  product: linux
  service: syslog
detection:
  selection:
    process_name: 'sshd'
    message|contains:
      - 'segfault'
      - 'signal 11'
      - 'core dumped'
  condition: selection
falsepositives:
  - Legitimate service crashes due to hardware failure or memory exhaustion
level: high


**KQL (Microsoft Sentinel / Defender)**

// Hunt for remote-to-remote SCP usage (CVE-2026-59996)
// Requires Linux Syslog or CEF data ingested into Syslog or CommonSecurityLog
Syslog
| where ProcessName contains "scp"
| where SyslogMessage has "@" 
| where SyslogMessage matches regex @".*@.*:.*@.*:.*"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| extend Reason = "Potential SCP Remote-to-Remote Copy detected"
;
// Hunt for SSHD Crashes (CVE-2026-60002)
Syslog
| where ProcessName == "sshd"
| where SyslogMessage has_any ("segfault", "signal 11", "core dumped")
| project TimeGenerated, Computer, Hostname, SyslogMessage
| extend Reason = "SSHD Daemon Crash detected - Potential Exploit"


**Velociraptor VQL**

-- Hunt for SCP processes using remote-to-remote syntax
SELECT Pid, Name, CommandLine, Username
FROM pslist()
WHERE Name = 'scp'
  AND CommandLine =~ '@.*:.*@.*:'


**Remediation Script (Bash)**

#!/bin/bash
# Remediation script for Fedora 44 OpenSSH CVEs
# Checks version and applies updates

echo "Checking Fedora Version and OpenSSH Status..."

# Check if we are on Fedora 44
if [[ -f /etc/fedora-release ]]; then
  FEDORA_VERSION=$(rpm -E %fedora)
  if [[ "$FEDORA_VERSION" == "44" ]]; then
    echo "Detected Fedora 44. Checking OpenSSH version..."
    
    # Get current OpenSSH version
    CURRENT_VERSION=$(rpm -q openssh --queryformat '%{VERSION}-%{RELEASE}')
    echo "Current OpenSSH Version: $CURRENT_VERSION"
    
    # Apply updates
    echo "Applying available security updates..."
    dnf update -y openssh openssh-server openssh-clients
    
    # Verify update
    UPDATED_VERSION=$(rpm -q openssh --queryformat '%{VERSION}-%{RELEASE}')
    if [[ "$CURRENT_VERSION" != "$UPDATED_VERSION" ]]; then
      echo "SUCCESS: OpenSSH updated from $CURRENT_VERSION to $UPDATED_VERSION"
      echo "It is recommended to restart the sshd service: systemctl restart sshd"
    else
      echo "INFO: System appears to be up to date or no update available yet."
      echo "Please verify manually against the Fedora 44 advisory." 
    fi
  else
    echo "This script is targeted for Fedora 44. Current version: $FEDORA_VERSION"
  fi
else
  echo "Fedora release file not found. This is not a Fedora system."
fi