CVE-2026-60002: openbsd openssh Use After Free

CVSS: 9.4v3.1CriticalAnalyzed

AliasesALPINE-CVE-2026-60002RHSA-2026:65900RHSA-2026:66410+2 more

Published 08-07-2026Last modified 08-07-2026

Vulnerability summary

CVE-2026-60002 is a critical (CVSS 9.4) Use After Free vulnerability in openbsd openssh. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.4/10

010

Critical · v3.1 (NVD)

EPSS score

0.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 4

OPENSUSE-SU-2026:21477-1 RHSA-2026:37382 RHSA-2026:47756 RHSA-2026:47757 RHSA-2026:76993 SUSE-SU-2026:22978-1+2 more

Timeline

08-07-2026
PublishedVulnerability first disclosed.
08-07-2026
Last modifiedVulnerability information updated.

Description

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

CVSS metrics

6 scores · 6 sources · 1 version

v3.19.4

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Redhat15 products

openssh< 0:9.9p1-7.el10_0.4 | < 0:8.7p1-45.el9_6.4
openssh-askpass< 0:9.9p1-7.el10_0.4 | < 0:8.7p1-45.el9_6.4
openssh-askpass-debuginfo< 0:9.9p1-7.el10_0.4 | < 0:8.7p1-45.el9_6.4
openssh-clients< 0:9.9p1-7.el10_0.4 | < 0:8.7p1-45.el9_6.4
openssh-clients-debuginfo< 0:9.9p1-7.el10_0.4

Show all 15

Ubuntu2 products

opensshAll versions (No fix recorded) | < 1:8.9p1-3ubuntu0.16 | < 1:8.9p1-3ubuntu0.16+Fips3 | < 1:9.6p1-3ubuntu13.18 | < 1:9.6p1-3ubuntu13.18+Fips1 | < 1:10.2p1-2ubuntu3.4
openssh-ssh1All versions (No fix recorded)

Alpine1 product