OpenSSH CVE-2026-60000

The target sshd must have GSSAPIAuthentication enabled (typically in Kerberos or Active Directory integrated deployments) - this is the exact configuration prerequisite drawn from the description's scoping of the bug to the GSSAPIAuthentication path, and GSSAPI is disabled by default in stock OpenSSH, which sharply limits the exposed population. Given PR:N/UI:N in the CVSS vector, no authentication or user interaction is required once GSSAPI is enabled and the service is network-reachable. The primary limiting factors are: non-default configuration (GSSAPI must be turned on), network reachability of the SSH port, and that the impact is availability-only (no code execution or data exposure).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) reflects a network-reachable, unauthenticated availability-only impact with no confidentiality or integrity loss. That base score is tempered heavily by other signals: EPSS is only 0.34% (26th percentile), and CISA's SSVC assessment states Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and only partial rather than total resource impact. There is no KEV listing and no public exploit identified at time of analysis. A notable caveat is that the CVSS vector implies exploitation against any default install, but the description scopes the bug to the GSSAPIAuthentication path, which is off by default - verify whether GSSAPI is enabled before treating this as broadly exploitable. Net assessment: a legitimate availability bug worth patching in Kerberos-integrated SSH fleets, but not an emergency for the majority of deployments that leave GSSAPI disabled.

An attacker with network reach to an internet-exposed sshd that has GSSAPIAuthentication enabled opens repeated connections and submits authentication attempts through the GSSAPI path, which fails to enforce MaxAuthTries. By sustaining many concurrent expensive negotiations, the attacker consumes server CPU and memory, degrading or denying SSH service for legitimate administrators. No public exploit is identified at time of analysis, and the low-complexity network vector (AC:L) makes scripting feasible, though the non-default GSSAPI requirement limits target scope.