CVE-2026-60002·OpenSSH vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.30% — higher than 21% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-60002 scores 7.7 on CVSS, so a successful attack would be serious — but at 0.30%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

OpenSSH clients before version 10.4p1-1 are vulnerable to a use-after-free memory corruption issue that occurs during host key re-exchange operations. This vulnerability can lead to client-side crashes or potential code execution when connecting to servers that rotate their host keys. Immediately update OpenSSH to version 10.4p1-1 or later to eliminate this memory safety defect.

sudo dnf update openssh-server openssh-clients openssh -y

How to check if you are affected

1. Step 1: Check OpenSSH version with `ssh -V` and `sshd -v` to identify if the installed version is older than 10.4p1-1
2. Step 2: Verify client-side SSH functionality by attempting key re-exchange with `ssh -v -o RekeyLimit=1M user@host` to observe if crashes occur during re-keying
3. Step 3: Review system logs with `journalctl -u ssh -n 100` or `tail -f /var/log/auth.log` for segmentation faults or memory-related SSH errors during active sessions
4. Step 4: Confirm the patch was applied by running `ssh -V` again and verifying the version reports 1:10.4p1-1 or higher

FAQ

Related OpenSSH CVEs

References

• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1
• https://www.openwall.com/lists/oss-security/2026/07/06/5