OpenSSH for Windows CVE-2026-83754

Requires the Windows OpenSSH component to be in use on an affected build (listed Windows 10, 11, and Server 2019/2022/2025 versions below the fixed patch levels). Exploitation is unauthenticated (PR:N) but gated by two concrete limiters drawn from the CVSS vector: User Interaction is Required (UI:R) - a user or client must actively initiate or accept the vulnerable SSH operation, strongly implying a victim must be induced to connect to or process data from an attacker-controlled SSH endpoint rather than a purely passive remote hit - and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap/memory state. Hosts patched to the fixed build (e.g., 10.0.26100.33650 for Server 2025, 10.0.19044.7807 for Windows 10 21H2) are not exploitable. The exact triggering direction is not stated in the description and should be verified against the MSRC advisory.

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 base score of 7.5 reflects an unauthenticated network vector (AV:N, PR:N) with full technical impact (C:H/I:H/A:H), consistent with the CISA SSVC 'Technical Impact: total' rating. However, two metrics meaningfully constrain real-world exploitability: Attack Complexity is High (AC:H) and User Interaction is Required (UI:R), which aligns with SSVC 'Automatable: no' - this is not a wormable, drive-by condition. SSVC 'Exploitation: none' and the absence of any CISA KEV listing or public POC confirm no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The UI:R flag is notable for an SSH component and suggests a client-side or connection-induced trigger (e.g., a victim connecting to a malicious endpoint) rather than a server listening-service attack; the terse description ('execute code over a network') does not clarify direction - verify attack direction with Microsoft's MSRC advisory. Net: a vendor-confirmed, patch-available code-execution flaw with total impact, but gated by high complexity and required user interaction, making targeted rather than mass exploitation the realistic threat model.

An attacker induces a victim's Windows OpenSSH client/service to process attacker-controlled SSH protocol data (consistent with UI:R and AV:N), triggering a heap-based buffer overflow (CWE-122) that corrupts memory and leads to arbitrary code execution. Because Attack Complexity is High, the attacker must win a non-trivial condition such as a specific memory state or timing. No public exploit code or active exploitation has been identified at time of analysis.