SSH Administration Service Vulnerability in Apache Software Foundation Products

CVE-2026-111239

What is CVE-2026-111239?

The optional SSH administration service poses a significant security risk as it grants unrestricted access to the administration shell for any user authenticated against the configured login domain. Importantly, this occurs without verifying if the user possesses an administrative role. As a result, an attacker with valid credentials, even those of a low-privileged user, can execute arbitrary code within the server process. To mitigate this risk, it is strongly recommended that users disable the SSH administration service, restrict network access from untrusted sources, and limit the login domain exclusively to users with administrative privileges.

References