medium CVSS 6.5 EPSS 0.29%

CVE-2026-60001·OpenSSH vulnerability

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

Severity
medium
Software
OpenSSH
Fixed in
10.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.29% — higher than 20% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 10.4

Fixed in: 10.4

How to fix this CVE

Update OpenSSH server to version 1:10.4p1-1 or later to enforce the minimum authentication delay correctly. This vulnerability allows attackers to bypass rate-limiting protections that prevent rapid authentication attempts, potentially enabling brute-force attacks. Apply this security update immediately across all systems running affected versions of OpenSSH.

sudo dnf update openssh-server && sudo systemctl restart sshd

Defensia detects this vulnerability

How to check if you are affected

  1. Check OpenSSH version: ssh -V or sshd -v to confirm installed version is below 10.4p1-1
  2. Verify sshd configuration: grep -i 'LoginGraceTime\|MaxAuthTries' /etc/ssh/sshd_config to review rate-limiting settings
  3. Search authentication logs: grep -E 'Failed password|Invalid user' /var/log/auth.log | tail -100 to identify rapid failed login attempts
  4. Confirm patch installation: dpkg -l openssh-server (Debian/Ubuntu) or rpm -qa openssh-server (RHEL/CentOS) to verify version is 10.4p1-1 or later

FAQ

What is CVE-2026-60001?

This vulnerability exists in OpenSSH's sshd daemon, which fails to properly enforce the configured minimum authentication delay between login attempts. An attacker can bypass this rate-limiting mechanism to perform faster brute-force attacks against SSH credentials.

Is CVE-2026-60001 being actively exploited?

No, CVE-2026-60001 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and has no public exploit available. However, the high CVSS score of 8.5 and the nature of the vulnerability warrant prompt patching.

What versions of OpenSSH are affected by CVE-2026-60001?

All versions of OpenSSH before 10.4p1-1 are vulnerable. The vulnerability is resolved in OpenSSH 10.4p1-1 and later releases.

How do I check if my server is vulnerable to CVE-2026-60001?

Run 'ssh -V' or 'sshd -v' on the target server and compare the version number to 10.4p1-1. If the installed version is lower, the system is vulnerable.

Does Defensia detect CVE-2026-60001?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2026-60001 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60001. Free for 1 server.

Get started free