low CVSS 3.7 EPSS 0.62%

CVE-2026-60000·OpenSSH vulnerability

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

Severity
low
Software
OpenSSH
Fixed in
10.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.62% — higher than 48% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 10.4

Fixed in: 10.4

How to fix this CVE

Update OpenSSH to version 1:10.4p1-1 or later to remediate a denial-of-service vulnerability in GSSAPI authentication handling. The vulnerability allows remote attackers to exhaust server resources by triggering excessive authentication retry logic without proper rate limiting on GSSAPI attempts. Prioritize this update for systems exposing SSH to untrusted networks.

sudo dnf update openssh-server -y && sudo systemctl restart sshd

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

Failed GSSAPI authentication attempts in rapid succession within short time windows; regex pattern: 'Failed GSSAPI|GSSAPI authentication (failed|error)' appearing more than MaxAuthTries threshold in /var/log/auth.log within 60-second intervals

How to check if you are affected

  1. Check installed OpenSSH version: ssh -V or sshd -v to confirm if running a version before 10.4p1
  2. Verify GSSAPI authentication is enabled in sshd config: grep -i gssapiauthentication /etc/ssh/sshd_config (if present and set to 'yes', the system is at risk)
  3. Search SSH logs for repeated GSSAPI authentication failures: grep -c 'GSSAPI' /var/log/auth.log or journalctl -u ssh | grep -i gssapi to identify potential exploitation attempts
  4. Confirm patch applied: ssh -V should report version 10.4p1 or higher, and verify with dpkg -l | grep openssh-server (Debian/Ubuntu) or rpm -qa | grep openssh-server (RHEL/CentOS)

FAQ

What is CVE-2026-60000?

CVE-2026-60000 is a denial-of-service vulnerability in OpenSSH's GSSAPI authentication handler where the MaxAuthTries limit is not properly enforced, allowing attackers to trigger resource exhaustion through repeated authentication attempts.

Is CVE-2026-60000 being actively exploited?

No, CVE-2026-60000 is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no public exploit code is available.

What versions of OpenSSH are affected by CVE-2026-60000?

All versions prior to 1:10.4p1-1 are affected; this includes OpenSSH 10.3 and earlier releases across all major Linux distributions.

How do I check if my server is vulnerable to CVE-2026-60000?

Run 'ssh -V' to display your version and compare against 10.4p1; if your version is lower, you are vulnerable. Additionally, check if GSSAPI is enabled with 'grep GSSAPIAuthentication /etc/ssh/sshd_config'.

Does Defensia detect CVE-2026-60000?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2026-60000 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60000. Free for 1 server.

Get started free