OpenSSH Vulnerabilities: Latest CVEs and Version Check

OpenSSH Security in Short

OpenSSH has a very good security record, so a serious flaw is rare and widely reported when it happens: regreSSHion in 2024, and SSHole in 2026. Because port 22 faces the internet on most servers, attackers scan for vulnerable versions within hours.

How to Keep OpenSSH Patched

Update through your distribution, then restart sshd. Existing sessions stay open.
Use SSH keys and turn off password logins (PasswordAuthentication no). That removes a whole class of attacks.
Limit who can reach port 22 with a firewall or VPN where you can.

The Past Eight Weeks

20 flaws, newest first.

5 Nov 2026 Security flaw sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password… CVE-2026-123158 8.1 Exploited

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Patch now · NVD Record

13 Oct 2026 Memory corruption Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. CVE-2026-97816 9.8

Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Patch now · NVD Record

13 Oct 2026 Path traversal Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. CVE-2026-83923 8.8

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Patch this week · NVD Record

13 Oct 2026 Memory corruption Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a netw… CVE-2026-88157 8.8

Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Patch this week · NVD Record

13 Oct 2026 Memory corruption Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. CVE-2026-83769 7.8

Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

Patch this week · NVD Record

13 Oct 2026 Memory corruption Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. CVE-2026-97811 7.8

Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

Patch this week · NVD Record

13 Oct 2026 Denial of service Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker t… CVE-2026-70163 7.5

Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.

Patch this week · NVD Record

13 Oct 2026 Memory corruption Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a netw… CVE-2026-83754 7.5

Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Patch this week · NVD Record

13 Oct 2026 Memory corruption Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. CVE-2026-83871 7.0

Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

Patch this week · NVD Record

7 Oct 2026 Security flaw In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. CVE-2026-106583 7.8

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

Patch this week · NVD Record

6 Oct 2026 Security flaw In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication a… CVE-2026-106553 7.5

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

Patch this week · NVD Record

6 Oct 2026 Security flaw In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across… CVE-2026-106555 7.5

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

Patch this week · NVD Record

6 Oct 2026 Path traversal In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unin… CVE-2026-106552 6.5

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

Keep an eye · NVD Record

6 Oct 2026 Denial of service In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded d… CVE-2026-106585 6.5

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

Keep an eye · NVD Record

6 Oct 2026 Security flaw In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tu… CVE-2026-106586 4.3

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

Keep an eye · NVD Record

6 Oct 2026 Security flaw In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindica… CVE-2026-106582 3.7

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

Keep an eye · NVD Record

6 Oct 2026 Security flaw In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight … CVE-2026-106584 3.3

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

Keep an eye · NVD Record

6 Oct 2026 Memory corruption In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a fil… CVE-2026-106587 3.3

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

Keep an eye · NVD Record

6 Oct 2026 Security flaw In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing… CVE-2026-106588 3.1

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

Keep an eye · NVD Record

6 Oct 2026 Privilege escalation In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can… CVE-2026-106589 2.9

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

Keep an eye · NVD Record

Being Exploited

OpenSSH flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 1 on the KEV page.

Patch now

OpenSSH

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authenticati…

Score 8.1 / 10 · Being exploited · Fixed in 10.6

CVE-2026-123158

Read: SSHole ›