{"id":"CVE-2026-111239","kind":"vulnerability","aliases":["CVE-2026-111239"],"related":[],"title":"SSH administration service lets any domain user run server code","description":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.","summary":"An optional SSH administration service gives every user who logs in through its configured login domain full access to the administration shell, without checking for an admin role. An attacker with any such user's credentials, including a low-privileged application user, can run arbitrary code as the server process.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","ssh"],"not_affected_if":["admin-only-login-domain","network-restricted","service-disabled"],"how_to_check":"- Check whether the SSH administration service is enabled on the server; the sources do not name the product or its settings, so this needs the vendor's documentation.\n- Check which login domain the service is configured to accept, and whether it includes non-administrative users.\n- Check whether the service's port is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:25:20+00:00","updated_at":"2026-11-10T16:25:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T16:25:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SSH administration service lets any domain user run server code","impact":"high","summary":"An optional SSH administration service gives every user who logs in through its configured login domain full access to the administration shell, without checking for an admin role. An attacker with any such user's credentials, including a low-privileged application user, can run arbitrary code as the server process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ssh","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the server process","analyst_note":"Identify the affected product and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111239; the sources name no product or fix.","how_to_check":"- Check whether the SSH administration service is enabled on the server; the sources do not name the product or its settings, so this needs the vendor's documentation.\n- Check which login domain the service is configured to accept, and whether it includes non-administrative users.\n- Check whether the service's port is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-disabled","admin-only-login-domain","network-restricted"],"who_is_affected":"Systems running the optional SSH administration service whose configured login domain includes users who are not administrators. Exposure is higher if the service is reachable from untrusted networks. Servers where the service is disabled, or where only administrative users can log in, are not affected according to the sources' recommendations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4564,"output_tokens":594,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111239':13A,16A '-2026':12A,15A 'access':39B,80C,140C 'admin':48B 'administr':2A,25B,42B,76C,83C,99C,134C,152C 'applic':63B,117C 'arbitrari':67B,121C 'attack':51B,102C 'authent':89C 'block':138C 'check':45B,96C 'client':145C 'code':10A,68B,122C 'configur':35B,92C 'credenti':57B,105C 'cve':11A,14A 'disabl':131C 'domain':6A,37B,94C,111C,150C 'everi':28B,86C 'execut':120C 'full':38B,79C 'give':27B 'grant':78C 'hold':103C 'host':20B 'includ':58B,112C 'infrastructur':17B 'let':4A 'log':31B 'login':36B,93C,149C 'low':61B,115C 'low-privileg':60B,114C 'network':139C 'option':23B,74C 'privileg':62B,116C 'process':72B,126C 'recommend':129C 'restrict':147C 'role':49B,100C 'run':8A,66B 'self':19B 'self-host':18B 'server':9A,71B,125C 'servic':3A,26B,77C,135C 'shell':43B,84C 'ssh':1A,21B,24B,75C,133C 'untrust':144C 'user':7A,29B,55B,64B,87C,108C,118C,127C,153C 'without':44B,95C","nicknames":[],"mitigations":[],"who_affected":"Systems running the optional SSH administration service whose configured login domain includes users who are not administrators. Exposure is higher if the service is reachable from untrusted networks. Servers where the service is disabled, or where only administrative users can log in, are not affected according to the sources' recommendations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","selfhosted","ssh","unknown"],"campaign_type":null,"search_a":"'-111239':13A,16A '-2026':12A,15A 'administr':2A 'code':10A 'cve':11A,14A 'domain':6A 'let':4A 'run':8A 'server':9A 'servic':3A 'ssh':1A 'user':7A","search_b":"'access':39B 'admin':48B 'administr':25B,42B 'applic':63B 'arbitrari':67B 'attack':51B 'check':45B 'code':68B 'configur':35B 'credenti':57B 'domain':37B 'everi':28B 'full':38B 'give':27B 'host':20B 'includ':58B 'infrastructur':17B 'log':31B 'login':36B 'low':61B 'low-privileg':60B 'option':23B 'privileg':62B 'process':72B 'role':49B 'run':66B 'self':19B 'self-host':18B 'server':71B 'servic':26B 'shell':43B 'ssh':21B,24B 'user':29B,55B,64B 'without':44B","search_c":"'access':80C,140C 'administr':76C,83C,99C,134C,152C 'applic':117C 'arbitrari':121C 'attack':102C 'authent':89C 'block':138C 'check':96C 'client':145C 'code':122C 'configur':92C 'credenti':105C 'disabl':131C 'domain':94C,111C,150C 'everi':86C 'execut':120C 'full':79C 'grant':78C 'hold':103C 'includ':112C 'login':93C,149C 'low':115C 'low-privileg':114C 'network':139C 'option':74C 'privileg':116C 'process':126C 'recommend':129C 'restrict':147C 'role':100C 'server':125C 'servic':77C,135C 'shell':84C 'ssh':75C,133C 'untrust':144C 'user':87C,108C,118C,127C,153C 'without':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111239","severity":null,"published_at":"2026-11-10T16:17:14+00:00","modified_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}