EUVD-2026-99414
GHSA-xm7c-pq6h-c8j2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OpenSSH (sshd) service over network
-
ExploitSend repeated unthrottled connection/resource requests
-
ExecutionExhaust unbounded server resources
-
ImpactDeny SSH service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the OpenSSH server component (sshd) to be installed, enabled, and network-reachable on an affected Windows build - on Windows this is an optional feature that is not enabled by default on most client installs, which meaningfully limits the attack surface. Where sshd IS running and exposed, no special configuration, authentication, or user interaction is needed (PR:N/UI:N): any attacker with network access to the SSH port can trigger the unthrottled resource allocation. Limiting factors are therefore the presence/exposure of the SSH server and whether the port is reachable (firewalled/internal-only deployments reduce exposure); impact is availability-only with no data exposure. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remotely reachable, low-complexity, unauthenticated denial-of-service with high availability impact and no confidentiality or integrity loss - consistent with the CWE-770 resource-exhaustion root cause. CISA's SSVC framework reports Exploitation: none (no observed in-the-wild activity), Automatable: yes (the flaw can be scripted/repeated at scale), and Technical Impact: partial, which aligns with a service-crash/resource-starvation outcome rather than system compromise. This CVE is NOT in CISA KEV and no POC was provided in the input, so exploitation remains theoretical at this time. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from the available data - STATED EXPLICITLY as missing. Net: a 7.5 'High' availability-only issue that is automatable and unauthenticated (so attractive for disruption/botnet-style abuse) but currently shows no evidence of active exploitation; prioritize patching on internet-exposed SSH endpoints while treating it as lower urgency than a code-execution or actively-exploited flaw. |
| Exploit ScenarioDerived | An attacker who can reach a Windows host running the OpenSSH server (sshd) over the network opens connections or sends requests that cause unbounded resource allocation, exhausting memory or handles until the SSH service becomes unresponsive. Because exploitation is unauthenticated and automatable (per SSVC), it could be scripted against many exposed endpoints. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
RemediationAI
Patch available per vendor advisory: Microsoft documents the fix in its update guide for CVE-2026-70163 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70163, and the ENISA EUVD data indicates remediated builds of 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.17763.9376 (Windows 10 1809, Server 2019 and Server Core), 10.0.20348.5761 (Server 2022) and 10.0.26100.33650 (Server 2025 and Server Core) - apply the corresponding Windows cumulative update from Microsoft rather than treating any build number here as a standalone KB identifier. Where patching cannot be scheduled immediately, the most effective compensating control is to remove the exposure rather than to filter the traffic: on any host that does not genuinely require inbound SSH, disable the OpenSSH Server optional feature or stop and disable the sshd service (trade-off: loss of remote SSH administration of that host, so confirm an out-of-band management path such as RDP or a console exists first). If SSH must stay available, restrict inbound TCP/22 (or the configured port) at the host firewall and at network boundaries to a bounded set of trusted management addresses and block it from untrusted networks - this does not fix the resource-exhaustion flaw, so a single allowed source can still degrade the service; additionally cap concurrent connections and per-source connection rates through the available SSH/sshd configuration and OS-level controls, accepting that such limits can reject legitimate bursts and are a mitigation, not a repair. Monitor sshd CPU, handle counts and connection churn for signs of unthrottled allocation, and prioritise internet- or partner-facing SSH endpoints over firewalled internal ones. No vendor-released patch is missing here; nothing in the data supports claims of active exploitation, so remediation can follow normal patch cycles for internet-exposed hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-770, allocation of resources without limits or throttling, meaning the affected component accepts work from a remote peer and commits memory, handles, threads or similar resources to it without an effective cap or rate limit. Applying that pattern to the OpenSSH for Windows server (sshd.dll / the OpenSSH Server optional feature, the Microsoft-flavoured OpenSSH port rather than the upstream OpenBSD project) yields a remotely triggerable exhaustion condition: the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms a network-reachable, low-complexity path requiring neither credentials nor user interaction, while C:N/I:N/A:H confirms the consequence is purely loss of availability - no confidentiality or integrity impact and no scope change. The attack surface is gated by deployment rather than by privilege: sshd is an optional Windows capability, so exposure exists only where administrators have installed and started the service and where TCP/22 (or a custom SSH port) is reachable from the attacker's network position; the SSVC 'automatable: yes' rating indicates the trigger is deterministic enough to be fired at scale by tooling, which is the primary reason a modest availability-only bug is still worth remediation. The EUVD cross-reference EUVD-2026-99414 tracks the same issue against Windows client and server SKUs.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable sshd with low-complexity resource exhaustion gives AV:N/AC:L/PR:N/UI:N; DoS yields A:H with C:N/I:N and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A high-severity denial-of-service flaw in the OpenSSH Server component of Windows can allow an unauthenticated attacker with network access to the SSH port to exhaust host resources and prevent legitimate administrators and automated jobs from establishing SSH sessions. Only Windows systems where the OpenSSH Server capability has been installed, enabled, and exposed to the network are affected, which limits exposure to a subset of servers and hardened endpoints rather than typical user laptops. Because the impact is confined to availability, leadership should prioritize identifying and patching those specific internet- or network-reachable SSH-enabled hosts to avoid operational disruption to remote administration and file-transfer workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB