CVE-2023-38408
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
CVSS
9.8
Critical
EPSS
79.7%
p100
KEV
—
Exploit Today
30
0-100
Published: Jul 20, 2023 · Last modified: Oct 15, 2026 · CWE-428
79.7%EPSS · 30 days79.7%
2026-09-222026-10-19
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/07/20/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/07/20/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/22/11
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/22/9
- blog.qualys.comhttps://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent
- github.comhttps://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8
- github.comhttps://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d
- github.comhttps://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/08/msg00021.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/
- news.ycombinator.comhttps://news.ycombinator.com/item?id=36790196
- security.gentoo.orghttps://security.gentoo.org/glsa/202307-01
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20230803-0010/
- support.apple.comhttps://support.apple.com/kb/HT213940
- www.openssh.comhttps://www.openssh.com/security.html
- www.openssh.comhttps://www.openssh.com/txt/release-9.3p2
- www.qualys.comhttps://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-153587.5 HIG65.0%
——20ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.28dCVE-2026-814697.8 HIG8.2%
——2Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges26dCVE-2026-572237.0 HIG4.1%
——1Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.22dCVE-2026-778277.1 HIG4.9%
——1Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80.37dCVE-2026-668396.7 MED9.0%
——3NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.54dCVE-2026-187557.3 HIG7.9%
——2A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legitimate library, the malicious code is loaded and executed under the security privileges of the GV-ASManager process.42d