CVE-2026-69397
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A use-after-free vulnerability in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. The issue stems from using freed memory.
Risk Assessment
A remote unauthenticated attacker could execute arbitrary code on the vulnerable system, potentially leading to full system compromise and lateral movement.
Recommendation
Immediately update OpenSSH for Windows to a patched version and restrict SSH access to trusted IP addresses only.
Other vulnerabilities in OpenSSH for Windows
See all- CVE-2026-97816Critical
OpenSSH for Windows is affected by a use after free vulnerability. This allows an unauthorized attacker to execute code over a network.
- CVE-2026-88157High
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- CVE-2026-83871High
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- CVE-2026-83769High
A use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- CVE-2026-83754High
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- CVE-2026-70163High
A vulnerability in OpenSSH for Windows involves allocation of resources without limits or throttling. An unauthenticated attacker can cause a denial of service over the network.
Original NVD description (English source)
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS