Vulnerability intelligence
CVE-2026-60002
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
CVSS Score
7.7
High
EPSS — Exploit Probability
0.3%
Riskier than 23% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Jul 8, 2026 · latest Jul 8, 2026
Coverage timeline
-
OpenSSH 10.4 fixes critical CVE-2026-60002 and other bugssecurityonline.info · Jul 8, 2026