CVE-2026-48851
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In PuTTY versions 0.77 through 0.83, the PuTTY icon is used as a trust indicator for TELNET data, but the trust status is not cleared between proxy authentication and the main session.
Risk Assessment
Users may be tricked into trusting data from an untrusted source, potentially leading to phishing attacks or session hijacking.
Recommendation
Update PuTTY to version 0.84 or later, which contains the fix.
Other vulnerabilities in PuTTY
See all- CVE-2017-6542Critical
The ssh_agent_channel_data function in PuTTY before version 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message, leading to a buffer overflow.
- CVE-2026-48852Low
PuTTY versions 0.71 through 0.83 have an assertion failure in ECDSA signature verification. The issue is fixed in version 0.84.
- CVE-2026-48850Low
PuTTY versions 0.72 through before 0.84 have a double free vulnerability in RSA KEX handling.
Original NVD description (English source)
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS