OpenSSH CVE-2026-60001

No special non-default configuration is required for the throttling bypass to be triggerable - the flaw exists in sshd's core authentication delay logic present in all default OpenSSH deployments prior to 10.4. The attack is most impactful when PasswordAuthentication or KbdInteractiveAuthentication is enabled in sshd_config, which is the default on most Linux distributions; deployments that have explicitly set PasswordAuthentication no and enforce public-key-only authentication face negligible incremental risk because public-key authentication is not susceptible to rapid credential guessing. The SSH service must be network-reachable (default TCP/22); firewall or network controls that restrict SSH access to known trusted source addresses prevent exploitation entirely. CVSS PR:N confirms no credentials or prior access are required to initiate an attack.

The NVD CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L correctly characterizes this as a remotely exploitable, zero-complexity flaw requiring no authentication, but with bounded impact: only limited integrity impact (accelerated credential guessing weakens the authentication posture) and limited availability impact (potential resource exhaustion from uninhibited connection floods). No EPSS score was included in the provided intelligence; exploitation probability relative to peer vulnerabilities cannot be quantified from available data. The vulnerability is not listed in CISA KEV and no proof-of-concept code is referenced, meaning no confirmed active exploitation exists at time of analysis. The practical real-world risk is concentrated in deployments where password-based or keyboard-interactive SSH authentication is enabled - environments using public-key-only authentication face negligible incremental risk because public-key negotiation is not meaningfully vulnerable to rapid-fire guessing. Despite the moderate CVSS score, the ubiquity of OpenSSH across production Linux and Unix infrastructure warrants treating this as a near-term patching priority, particularly for Internet-exposed SSH services.

An unauthenticated remote attacker targets an Internet-exposed SSH service running OpenSSH prior to 10.4 with password authentication enabled, using an automated tool to submit successive login attempts against a target account without observing the per-attempt delay sshd is supposed to enforce. The attacker cycles through a credential list at a rate significantly higher than the daemon intends, increasing the probability of a successful brute-force match against accounts using weak, common, or reused passwords. No public exploit code is currently referenced; the attack requires only standard SSH client tooling capable of scripted authentication attempts.