OpenSSH for Windows EUVD-2026-100055

Exploitation requires the victim to use the OpenSSH for Windows component and to initiate/accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement) - it is not triggerable by an attacker purely on their own. The CWE-23 relative path traversal must be reachable through that SSH interaction to write files outside the intended directory and achieve code execution. Limiting factors: the OpenSSH feature must be present/in use on the Windows host, the user must perform the connecting action, and the host must be below the fixed build (e.g. Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761). No authentication is required of the attacker (PR:N), and SSVC rates exploitation as not automatable.

This is a genuine high-priority issue on paper (CVSS 8.8, C:H/I:H/A:H, Technical Impact: total per SSVC) but the real-world signals currently temper the urgency. The CVSS vector is AV:N/AC:L/PR:N/UI:R: network-reachable, low complexity, and unauthenticated (PR:N), but exploitation requires user interaction (UI:R) - most plausibly a user initiating an SSH connection to an attacker-controlled endpoint, which is why the attacker is 'unauthorized' yet still needs the victim to act. Countervailing signals: SSVC reports Exploitation 'none' and Automatable 'no', and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not currently a mass-exploitation scenario. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: patch promptly because impact is total and the component ships in Windows, but the UI:R requirement plus SSVC 'Automatable: no' make opportunistic wormable exploitation unlikely - this favors prioritized patching over emergency response absent new exploit intelligence.

An attacker lures a victim into connecting their Windows OpenSSH client to a malicious or compromised SSH server (satisfying UI:R). During the session the server returns crafted path-traversal content (CWE-23 relative path) that escapes the intended directory to write a file to an attacker-chosen location, resulting in code execution on the victim host. No public exploit code has been identified at time of analysis.