Ubuntu Security Notices USN-8577-1 USN-8577-1: OpenSSH vulnerability Publication date 21 July 2026 Overview OpenSSH could allow unintended access to network services. Releases 16.04 LTS Open side navigation Close side navigation Packages Details Update instructions References Related notices Packages openssh - secure shell (SSH) for secure access to remote machines Details USN-8222-1 fixed a vulnerability in OpenSSH. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys in authorized_keys and an authorized_keys principals="" option that lists more than one principal. This could result in inappropriate principal matching, contrary to expectations. ( CVE-2026-35414 ) USN-8222-1 fixed a vulnerability in OpenSSH. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys in authorized_keys and an authorized_keys principals="" option that lists more than one principal. This could result in inappropriate principal matching, contrary to expectations. ( CVE-2026-35414 ) Update instructions In general, a standard system update will make all the necessary changes. Learn more about how to get the fixes. The problem can be corrected by updating your system to the following package versions: Ubuntu Release Package Version 16.04 LTS xenial openssh-server – 1:7.2p2-4ubuntu2.10+esm9 Ubuntu Pro Fix available with Ubuntu Pro via Legacy Support add-on. Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. Get Ubuntu Pro References CVE-2026-35414 CVE-2026-35414 Related notices USN-8222-1 USN-8222-1