CVE-2026-60002

HighCVSS 7.7

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

In OpenSSH before version 10.4, a use-after-free vulnerability exists in the SSH client during key re-exchange when a server changes its host key. This issue affects only the client side.

Risk Assessment

A malicious SSH server could exploit this vulnerability to achieve remote code execution or crash the SSH client, potentially leading to session hijacking or data leakage.

Recommendation

Immediately upgrade OpenSSH to version 10.4 or later on all client systems. If upgrading is not possible, restrict trust to SSH servers that change host keys.

Original NVD description (English source)

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)