OpenSSH for Windows EUVD-2026-99587

Exploitation requires the OpenSSH for Windows component to be present and in use, and the CVSS UI:R metric means a victim must actively initiate the vulnerable operation - consistent with a client-side vector where a Windows user connects their OpenSSH client to an attacker-controlled or compromised SSH server. The attacker needs no prior authentication (PR:N) and the path is network-reachable (AV:N) with low complexity (AC:L), but the required user interaction and the need for the victim to connect to attacker-influenced infrastructure are the key limiting factors that reduce real-world exploitability; this also aligns with SSVC Automatable: no. The exact triggering feature is not specified in the terse description - confirm server-side versus client-side scope against the Microsoft MSRC advisory. Patched builds are enumerated per Windows version (e.g., Windows Server 2025 fixed in 10.0.26100.33650, Windows 11 24H2 in 10.0.26100.9711).

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R, indicating a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction, yielding total impact (C:H/I:H/A:H). These signals partly conflict with CISA's SSVC assessment, which rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' - the latter is consistent with the UI:R requirement, since an attacker cannot mass-automate exploitation if a victim must actively initiate a connection or action. SSVC Technical Impact of 'total' aligns with the CVSS C/I/A:H rating. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so this is 'no public exploit identified at time of analysis.' The combination of high technical impact but non-automatable, user-interaction-gated exploitation and no observed exploitation suggests this is a genuinely serious-but-not-yet-urgent patch-priority issue rather than a drop-everything emergency: the total-impact RCE warrants prompt patching, but the UI:R gate and SSVC 'Exploitation: none' temper real-world urgency. Note the PR:N/UI:R pattern combined with 'OpenSSH for Windows' strongly implies a client-side vector (victim connects to a malicious SSH endpoint) rather than a server-side pre-auth overflow - this should be verified against the Microsoft advisory, as it materially changes who is at risk.

An attacker stands up a malicious or compromised SSH server (or performs a man-in-the-middle on an SSH session) and lures or waits for a Windows user or administrator to connect using the built-in OpenSSH for Windows client. During the connection, the server returns crafted protocol data that triggers a heap-based buffer overflow, allowing the attacker to execute arbitrary code in the context of the connecting user. No public proof-of-concept or active exploitation is identified in the provided data, and the UI:R requirement means a victim must initiate the vulnerable connection.