CVE-2026-60000
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in OpenSSH before version 10.4 allows remote attackers to cause a denial of service (DoS) via excessive GSSAPI authentication attempts. The issue stems from improper handling of the MaxAuthTries limit for GSSAPIAuthentication.
Risk Assessment
An attacker can exhaust SSH server resources, making the service unavailable to legitimate users. This may lead to disruptions in critical remotely managed systems.
Recommendation
Immediately upgrade OpenSSH to version 10.4 or later. If an upgrade is not possible, consider temporarily disabling GSSAPIAuthentication in the sshd configuration.
Original NVD description (English source)
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.