Oracle has released a critical security update for Oracle Linux 10, flagged under advisory ELSA-2026-47757. This update addresses multiple severe vulnerabilities within the OpenSSH suite, a cornerstone component for remote administration and secure file transfer.
The vulnerabilities impact core functionalities including remote-to-remote copying mechanisms and underlying memory management routines. For defenders, this is a high-priority event. OpenSSH runs as root on most Unix-like systems; a successful memory corruption exploit or logic flaw in remote copying operations could lead to full system compromise, lateral movement, or data exfiltration. Given the privileged position of SSH daemons in infrastructure, we treat this with the same urgency as a remote code execution (RCE) advisory.
Technical Analysis
Affected Product & Versions:
- Platform: Oracle Linux 10
- Component: OpenSSH
- Advisory: ELSA-2026-47757
Vulnerability Details: While specific CVE identifiers are detailed in the full Oracle advisory, the release notes highlight two primary vectors of concern:
-
Remote-to-Remote Copying Issues: Flaws in the logic handling
scpandsftpoperations where data is copied between two remote systems (often referred to as "third-party" copies or using the-3flag in scp). These bugs can potentially allow malicious servers to read or write files outside the intended directory structure, or manipulate client-side logic. -
Memory Management Flaws: Issues related to buffer handling and memory allocation within the SSH daemon (
sshd) and client utilities. These are classic exploitation vectors for memory corruption attacks, potentially leading to Denial of Service (DoS) or Arbitrary Code Execution (ACE) if triggered by a malicious authenticated or pre-authentication actor.
Exploitation Status: At the time of this advisory release, these flaws are addressed via software patches. While there is no indication of widespread, automated exploitation in the wild akin to a Log4j-scale event, the nature of OpenSSH makes it a prime target for targeted exploitation. Nation-state actors and sophisticated ransomware groups routinely scan for and weaponize SSH protocol flaws. We assume that proof-of-concept (PoC) code will be available quickly, reducing the window for remediation.
Detection & Response
Detecting exploitation of these specific flaws requires a layered approach. Since one vulnerability involves remote-to-remote copying (specific behavior), we can hunt for anomalies in scp usage. Memory corruption bugs often result in service crashes (segfaults) before successful exploitation is achieved, providing a precursor indicator.
Sigma Rules
The following Sigma rules target suspicious scp usage indicative of potential remote-to-remote copying exploitation and monitor for sshd process crashes that may indicate attempted memory corruption.
---
title: Potential OpenSSH Remote-to-Remote Copying Anomaly
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects usage of scp with flags often associated with remote-to-remote copying (-3) or suspicious argument patterns which may indicate attempts to exploit logic flaws in file transfer protocols.
references:
- https://linuxsecurity.com/advisories/oracle/oracle10-elsa-2026-47757-openssh
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
- attack.lateral_movement
- attack.t1021.004
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: '/scp'
CommandLine|contains:
- '-3'
condition: selection
falsepositives:
- Legitimate administrative scripts using scp for proxy transfers
level: medium
---
title: OpenSSH Daemon Memory Corruption Crash
id: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5e
status: experimental
description: Detects segmentation faults or abort signals in sshd, which may indicate attempts to exploit memory management flaws or failed buffer overflow attacks.
references:
- https://linuxsecurity.com/advisories/oracle/oracle10-elsa-2026-47757-openssh
author: Security Arsenal
date: 2026/04/06
tags:
- attack.defense_evasion
- attack.t1499.004
- cves.2026
logsource:
product: linux
service: syslog
detection:
selection_keywords:
Message|contains:
- 'sshd'
- 'segfault'
- 'core dumped'
- 'fatal'
selection_process:
Message|contains:
- 'killed'
- 'terminated'
filter_systemd:
Message|contains:
- 'systemd' # Filter generic systemd noise if necessary, adjust based on env
condition: 1 of selection* and not filter_systemd
falsepositives:
- Legitimate service restarts
- Hardware instability
level: high
KQL (Microsoft Sentinel / Defender)
This query hunts for abnormal SSH connection patterns and process crashes indicative of exploitation attempts against OpenSSH.
// Hunt for OpenSSH crashes and suspicious SCP activity
Syslog
| where SyslogMessage contains "sshd"
// Look for memory corruption indicators
| where SyslogMessage has_any ("segfault", "core dump", "killed by signal", "memory violation")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| union (
DeviceProcessEvents
| where FileName =~ "scp"
// Look for -3 flag (remote-to-remote) or unusual redirection
| where ProcessCommandLine contains "-3" or ProcessCommandLine contains ">"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
)
| order by TimeGenerated desc
Velociraptor VQL
Use this VQL artifact to identify systems running the vulnerable OpenSSH packages or check for recent sshd crash logs.
-- Check for OpenSSH version and recent crash logs
SELECT
OSPath,
Created,
Modified,
Data.Size
FROM glob(globs="/var/log/secure*")
WHERE Modified < now() - 24h
-- Note: Parse logs for 'segfault' or 'sshd' errors in a real investigation
-- Check installed package version (RHEL/Oracle Linux based)
SELECT
Name,
Version,
Release,
Arch,
Installtime
FROM rpm_packages()
WHERE Name =~ "openssh"
Remediation Script (Bash)
The following script can be deployed via your configuration management tooling (Ansible, SaltStack) or run manually to verify and apply the ELSA-2026-47757 update.
#!/bin/bash
# Remediation script for ELSA-2026-47757 (OpenSSH)
# Checks current version and applies updates for Oracle Linux 10
set -e
echo "[+] Checking current OpenSSH version..."
rpm -qa openssh openssh-server
echo "[+] Cleaning yum metadata..."
yum clean metadata
echo "[+] Updating OpenSSH packages via ELSA-2026-47757..."
yum update -y openssh openssh-server openssh-clients
echo "[+] Verifying update..."
UPDATED_VERSION=$(rpm -q --queryformat '%{VERSION}-%{RELEASE}' openssh-server)
echo "[+] Current OpenSSH Server Version: $UPDATED_VERSION"
echo "[+] Restarting sshd to ensure new binary is active..."
systemctl restart sshd
echo "[+] Remediation complete. Please verify output against Oracle Linux advisory."
Remediation
1. Immediate Patching: The primary remediation is to apply the Oracle Linux 10 update immediately. Use the following commands on your Oracle Linux 10 instances:
sudo dnf update --releasever=10
# OR specifically update openssh
sudo dnf update openssh
**2. Verification:**
After updating, verify that the installed version matches the patched release specified in ELSA-2026-47757. Ensure the `sshd` service restarted successfully:
sudo systemctl status sshd
rpm -q openssh-server
**3. Access Control Review:**
While patching, review /etc/ssh/sshd_config. Ensure PermitRootLogin is set to no (or prohibit-password), and utilize AllowGroups or AllowUsers to restrict remote access strictly to necessary administrative accounts. This limits the blast radius if exploitation is attempted before the patch is fully deployed.
4. Official Advisory: Refer to the official Oracle Linux advisory for the specific package versions and changelog details: Oracle Linux ELSA-2026-47757.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.