Qualys TRU Uncovers OpenSSH Vulnerabilities CVE‑2025‑26465 & CVE‑2025‑26466 | Qualys

Summary: Qualys' Threat Research Unit identified two OpenSSH vulnerabilities: CVE-2025-26465, an active machine-in-the-middle attack on the client when VerifyHostKeyDNS is enabled (introduced December 2014, before OpenSSH 6.8p1), and CVE-2025-26466, a pre-authentication denial-of-service affecting both client and server (introduced August 2023, before OpenSSH 9.5p1). OpenSSH 9.9p2 addresses both, and the affected ranges are 6.8p1 through 9.9p1 for CVE-2025-26465 and 9.5p1 through 9.9p1 for CVE-2025-26466.
Key Takeaway: A successful man-in-the-middle via CVE-2025-26465 lets the client accept an attacker's key instead of the legitimate server's, enabling interception of credentials and lateral movement across critical servers; repeated exploitation of CVE-2025-26466 can lock administrators out of the servers they manage.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-26465 CVE-2025-26466
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026