SB2026081103 - IBM Power Hardware Management Console (HMC) update for OpenSSH

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081103

SB2026081103 - IBM Power Hardware Management Console (HMC) update for OpenSSH

Published: August 11, 2026

Security Bulletin ID SB2026081103
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-35387)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass configured public key algorithm restrictions.

The vulnerability exists due to improper access control in sshd(8) when applying PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms to ECDSA keys. A remote user can authenticate using an unlisted ECDSA algorithm to bypass configured public key algorithm restrictions.

The issue occurs when one of these directives includes any ECDSA algorithm name.


Remediation

Install update from vendor's website.

References