CVE-2025-26465
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
02 Description
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
03 Exploitation and scoring
- Exploitation
- Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
- SSVC decision
- ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 7.72% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 94.2% of scored records. A rank, not a probability.
- NVD base score
- 6.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-10-21.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2025-02-18 18:27Z1 YR AGO
- Last updated
- 2026-10-21 20:12Z8 DAYS AGO
- Reserved
- 2025-02-10
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-390Detection of Error Condition Without ActionBase
- Data version
- 5.2
- Document digest
- 5984f7246d95b35c369b2c816f9b9af6b235e4bc294cbcd983c030843325e865
05 Affected products
06 References
- access.redhat.comRHSA-2025:16823https://access.redhat.com/errata/RHSA-2025:16823
- access.redhat.comRHSA-2025:3837https://access.redhat.com/errata/RHSA-2025:3837
- access.redhat.comRHSA-2025:6993https://access.redhat.com/errata/RHSA-2025:6993
- access.redhat.comRHSA-2025:8385https://access.redhat.com/errata/RHSA-2025:8385
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2025-26465
- access.redhat.comhttps://access.redhat.com/solutions/7109879
- bugzilla.redhat.comRHBZ#2344780https://bugzilla.redhat.com/show_bug.cgi?id=2344780
- seclists.orghttps://seclists.org/oss-sec/2025/q1/144
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/02/msg00020.html
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2025/02/18/1
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2025/02/18/4
- www.theregister.comhttps://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
- bugzilla.suse.comhttps://bugzilla.suse.com/show_bug.cgi?id=1237040
- security-tracker.debian.orghttps://security-tracker.debian.org/tracker/CVE-2025-26465
- ftp.openbsd.orghttps://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
- ubuntu.comhttps://ubuntu.com/security/CVE-2025-26465
- www.openssh.comhttps://www.openssh.com/releasenotes.html#9.9p2
- blog.qualys.comhttps://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
- lists.mindrot.orghttps://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20250228-0003/
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
- www.vicarius.iohttps://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
- seclists.orghttp://seclists.org/fulldisclosure/2025/May/8
- seclists.orghttp://seclists.org/fulldisclosure/2025/May/7
- seclists.orghttp://seclists.org/fulldisclosure/2025/Feb/18
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-585531.html
07 Fixed in
AlmaLinux 8
- openssh Fixed in 8.0p1-26.el8_10
- openssh-askpass Fixed in 8.0p1-26.el8_10
- openssh-cavs Fixed in 8.0p1-26.el8_10
- openssh-clients Fixed in 8.0p1-26.el8_10
- openssh-keycat Fixed in 8.0p1-26.el8_10
- openssh-ldap Fixed in 8.0p1-26.el8_10
- openssh-server Fixed in 8.0p1-26.el8_10
- pam_ssh_agent_auth Fixed in 0.10.3-7.26.el8_10
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 9
- openssh Fixed in 8.7p1-45.el9
- openssh-askpass Fixed in 8.7p1-45.el9
- openssh-clients Fixed in 8.7p1-45.el9
- openssh-keycat Fixed in 8.7p1-45.el9
- openssh-server Fixed in 8.7p1-45.el9
- pam_ssh_agent_auth Fixed in 0.10.4-5.45.el9
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- openssh Fixed in 8.0p1-26.el8_10
- openssh-askpass Fixed in 8.0p1-26.el8_10
- openssh-cavs Fixed in 8.0p1-26.el8_10
- openssh-clients Fixed in 8.0p1-26.el8_10
- openssh-keycat Fixed in 8.0p1-26.el8_10
- openssh-ldap Fixed in 8.0p1-26.el8_10
- openssh-server Fixed in 8.0p1-26.el8_10
- pam_ssh_agent_auth Fixed in 0.10.3-7.26.el8_10
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- openssh Fixed in 8.7p1-45.el9
- openssh-askpass Fixed in 8.7p1-45.el9
- openssh-clients Fixed in 8.7p1-45.el9
- openssh-keycat Fixed in 8.7p1-45.el9
- openssh-server Fixed in 8.7p1-45.el9
- pam_ssh_agent_auth Fixed in 0.10.4-5.45.el9
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- openssh Fixed in 1:9.2p1-2+deb12u5
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- openssh Fixed in 1:9.9p2-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- openssh Fixed in 1:9.9p2-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- openssh Fixed in 1:8.2p1-4ubuntu0.12
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- openssh Fixed in 1:8.9p1-3ubuntu0.11
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- openssh Fixed in 1:9.6p1-3ubuntu13.8
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 25.10
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.04 LTS
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.10
- openssh-ssh1 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- openssh Fixed in 1:7.2p2-4ubuntu2.10+esm7Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- openssh Fixed in 1:7.6p1-4ubuntu0.7+esm4Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-preview 22.04 LTS
- openssh No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-updates 16.04 LTS
- openssh Fixed in 1:7.2p2-4ubuntu2.fips.2.10.7Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-updates 18.04 LTS
- openssh Fixed in 1:7.9p1-10~ubuntu18.04.fips.0.10Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-updates 20.04 LTS
- openssh Fixed in 1:8.2p1-4ubuntu0.fips.0.12Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-updates 22.04 LTS
- openssh Fixed in 1:8.9p1-3ubuntu0.11+Fips1Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS-updates 24.04 LTS
- openssh Fixed in 1:9.6p1-3ubuntu13.12+Fips1Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS 16.04 LTS
- openssh No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS 18.04 LTS
- openssh No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro FIPS 20.04 LTS
- openssh No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.