Microsoft Security Response Center Follow CVE-2026-59996 scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59996 msrc.microsoft.com
