“Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary commands on vulnerable OpenSSH forwarded ssh-agent.”
Agent forwarding is the feature people use so their private keys never get stored on remote machines. Qualys turned it into remote code execution against the agent itself, with a working exploit on Ubuntu Desktop 22.04 and 21.10. The draft advisory went to OpenSSH on July 6 and the fix shipped July 19. Every box you forward your agent to is a box that can reach back.