Is CVE-2026-93995 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93995 being exploited in the wild.

How severe is CVE-2026-93995?

Medium severity, with a CVSS score of 6.5, published 30 September 2026.

Which products and versions are affected?

Apache MINA SSHD up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.

Is there a fix for CVE-2026-93995?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93995 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93995?

Check whether you run Apache MINA SSHD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93995: Apache MINA SSHD improper input validation in sshd-git

CVE-2026-93995 · Severity: medium · CVSS 6.5 · Published 2026-09-30

Apache MINA SSHD is a Java library that enables SSH clients and servers to execute commands remotely. The sshd-git component allows authenticated users to run git commands on server repositories through a mechanism that was previously restricted for security. A flaw in the validation allows attackers to bypass these restrictions and write files to the server filesystem, potentially leading to data compromise or service disruption.

Technologies: Apache MINA SSHD. Vendors: Apache.

Quick answers

Is CVE-2026-93995 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93995 being exploited in the wild.
How severe is CVE-2026-93995?: Medium severity, with a CVSS score of 6.5, published 30 September 2026.
Which products and versions are affected?: Apache MINA SSHD up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Is there a fix for CVE-2026-93995?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93995 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93995?: Check whether you run Apache MINA SSHD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation flaw in the GitPgmCommandFactory component fails to properly block the single-argument "-o=file.zip" variant of git archive command parameters, allowing authenticated SSH clients to write output files to the server despite prior restrictions. The vulnerability affects versions up to 2.19.0 and 3.0.0-M1 through 3.0.0-M5, and requires prior SSH authentication to exploit.

Affected products

Apache MINA SSHD up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.