CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2025-32433

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Erlang Erlang/OTP CWE-306

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVSS Score
10
Critical
EPSS — Exploit Probability
98%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2025-06-30
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-06-30.

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered May 13, 2026 · latest May 13, 2026

Tracked incidents

incident closed 2 articles
Gentlemen RaaS internal database leak exposes member accounts and chats

Associated threat actors

The Gentlemen

Coverage timeline