Skip to main content

SSH CVE-2026-60002

| EUVDEUVD-2026-42146 CRITICAL
Use After Free (CWE-416)
2026-07-08 mitre GHSA-gp5v-jg37-fvg6
Information Disclosure Use After Free Memory Corruption SSH Microsoft Openssh Openbsd
9.4
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 09, 2026

Memory corruption in the OpenSSH client (ssh) before 10.4 lets a malicious or compromised SSH server trigger a use-after-free on the connecting client by changing its host key during a key re-exchange (rekey), potentially leading to information disclosure or code execution in the client process. Only the client side is affected; the server is not vulnerable. There is no public exploit identified at time of analysis and it is not on CISA KEV, and EPSS is low (0.25%, 16th percentile), but the flaw is fixed in OpenSSH 10.4/10.4p1.

Earlier versions of this analysis (2)
v2 Jul 09, 2026 - 16:43 cvss changed CVSS 9.4

Memory disclosure and potential corruption in the OpenSSH client (ssh) before 10.4 arises when a malicious or compromised server presents a changed host key during SSH key re-exchange, triggering a use-after-free (CWE-416) on the client side only. Rated CVSS 9.4 with a high confidentiality impact, it could let a hostile server read freed client-side memory - potentially session material - or crash the client. No public exploit identified at time of analysis, EPSS is low (0.25%, 16th percentile), and it is not in CISA KEV; a fixed release (OpenSSH 10.4/10.4p1) is available.

v1 Jul 08, 2026 - 01:20 CVSS 7.7

Client-side memory corruption in OpenSSH before 10.4 (fixed in 10.4p1) allows a malicious or compromised SSH server to trigger a use-after-free in the connecting ssh client when it changes its host key during a key re-exchange (CWE-416). Reported via MITRE with a CVSS of 7.7, the flaw affects only the client side and can lead to information disclosure or potential code execution in the client process; no public exploit identified at time of analysis. Because the OpenSSH client is nearly universal on Unix/Linux systems, the exposed population is very large even though exploitation requires attacker-controlled server infrastructure and a difficult race condition.

Affected VersionsENISA

OpenSSH 0 <10.4

Affected Packages

euvd openssh fix: 10.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when SSH gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY HIGH
NVD 9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI 6.4 MEDIUM

Victim must connect to a hostile server (UI:R) and the attacker must win the rekey host-key-change race (AC:H); primary impact is client memory disclosure (C:H) with lesser integrity/availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat 7.7 HIGH

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

6
Analysis Updated
Jul 09, 2026 - 16:43 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 09, 2026 - 16:43 vuln.today
v2 - CVSS changed
Severity Changed
Jul 09, 2026 - 16:37 NVD
HIGH CRITICAL
CVSS changed
Jul 09, 2026 - 16:37 NVD
7.7 (HIGH) 9.4 (CRITICAL)
Patch available
Jul 08, 2026 - 02:01 EUVD
CVE Published
Jul 08, 2026 - 00:17 cve.org
HIGH 7.7

DescriptionNVD

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

Executive ViewAI

Why It Matters

OpenSSH client versions before 10.4 contain a critical memory corruption flaw that enables attackers to execute code on client systems when users connect to compromised servers. This directly threatens remote infrastructure administrators and users whose systems could be silently compromised during routine access, requiring immediate inventory and patching.

Recommended Action

Within 24 hours: Audit all systems running OpenSSH client to identify versions prior to 10.4. Within 7 days: Deploy OpenSSH 10.4 or 10.4p1 across all affected systems. Within 30 days: Verify patch deployment across 100% of affected inventory and confirm client version compliance.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 84% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

47
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +47
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in OpenSSH File Transfer and Auth Security Flaws

View all 8
CVE-2026-60000 HIGH
7.5
CVE-2026-60001 MEDIUM
6.5
CVE-2026-59995 MEDIUM POC
5.4
CVE-2026-59999 HIGH
7.5
CVE-2026-59996 MEDIUM
5.4
CVE-2026-59997 MEDIUM
5.4
CVE-2026-59998 MEDIUM
6.5

More in SSH

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2014-6278 HIGH POC
8.8 Sep 30

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2012-6066 CRITICAL POC
9.3 Dec 04

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
CVE-2014-6277 CRITICAL POC
10.0 Sep 27

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
CVE-2023-38408 CRITICAL POC
9.8 Jul 20

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
CVE-2026-123158 HIGH POC
8.1 Nov 05

Password authentication bypass in OpenSSH sshd before 10.6p2 built against musl libc without PAM lets a remote, unauthen
CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:37382 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-60002 ADVISORY https://ubuntu.com/security/notices/USN-8533-1 ADVISORY https://vuldb.com/vuln/376762 REF https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2 REF https://www.openssh.org/releasenotes.html#10.4p1 REF https://www.openwall.com/lists/oss-security/2026/07/06/5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy