OpenSSH internal-sftp argument truncation (CVE-2026-59997)

Summary

Security-related arguments after the ninth argument may be ignored.

Vulnerability ID	Vulnerability Overview
CVE-2026-59997	The internal-sftp subsystem recognizes only its first nine command-line arguments. Later arguments intended to enforce restrictions may not take effect, weakening the configured security policy.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices