Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
8 versions affected across 6 products
Two critical OpenSSH vulnerabilities discovered! Qualys TRU finds client and server flaws (CVE-2025-26465 & CVE-2025-26466) enabling MITM and… https://f.mtr.cool/vvhqednxzz
Post summary
Qualys announced two critical OpenSSH flaws (CVE-2025-26465 & CVE-2025-26466) that allow MITM attacks, but no PoC, exploit, or patch details were provided.
10 of 10 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 12.0 | - | - |
| App | netapp | active_iq_unified_manager | - | vmware_vsphere | - |
| App | netapp | ontap | 9 | - | - |
| App | openbsd | openssh | - | - | - |
| App | openbsd | openssh | 6.8 | - | - |
| App | openbsd | openssh | 9.9 | - | - |
| App | openbsd | openssh | 9.9 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | openshift_container_platform | 4.0 | - | - |