This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · OpenSSH

OpenSSH Vulnerabilities

The latest security flaws in OpenSSH, the remote login server on almost every Linux machine, and whether your version is affected.

New flaws, 30 days
9
Critical, 8 weeks
1
On CISA's exploited list
1
Latest exploited
9 Nov 2026

Run ssh -V, or sshd -V, on the server.

OpenSSH Security in Short

OpenSSH has a very good security record, so a serious flaw is rare and widely reported when it happens: regreSSHion in 2024, and SSHole in 2026. Because port 22 faces the internet on most servers, attackers scan for vulnerable versions within hours.

How to Keep OpenSSH Patched

  • Update through your distribution, then restart sshd. Existing sessions stay open.
  • Use SSH keys and turn off password logins (PasswordAuthentication no). That removes a whole class of attacks.
  • Limit who can reach port 22 with a firewall or VPN where you can.

The Past Eight Weeks

Any Score 7+ 8+ 9+

1 flaw scored 9+, newest first.

13 Oct 2026 Memory corruption Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. CVE-2026-97816 9.8

Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Patch now · NVD Record

Being Exploited

OpenSSH flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 1 on the KEV page.

Patch now

OpenSSH

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authenticati…

Score 8.1 / 10 · Being exploited · Fixed in 10.6

CVE-2026-123158

Read: SSHole ›

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions