Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-06-30. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
RISING
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 36 products
| Date | Total | Labels |
|---|
| 2026-02-08 | 1 | PoC1 |
| 2026-02-12 | 1 | General1 |
| 2026-02-14 | 1 | PoC1 |
| 2026-02-15 | 3 | Disclosure1General1PoC1 |
| 2026-02-16 | 1 | Exploit1 |
| 2026-03-07 | 1 | PoC1 |
| 2026-03-14 | 1 | General1 |
| 2026-03-15 | 1 | Disclosure1 |
| 2026-05-08 | 1 | General1 |
| 2026-06-22 | 1 | Patch1 |
| 2026-07-12 | 1 | Disclosure1 |
| 2026-08-17 | 2 | Exploit1General1 |
| 2026-09-19 | 2 | General1PoC1 |
How I Used AI to Create a Working Exploit for CVE-2025-32433 Before Public PoCs Existed - Matthew Keeley https://platformsecurity.com/blog/CVE-2025-32433-poc
Post summary
The article announces that the author used AI to create and share a functional exploit for CVE‑2025‑32433 before any public PoCs were available.
@dez_ @_RastaMouse It’s been great, even with the older models! https://platformsecurity.com/blog/CVE-2025-32433-poc I think OSS software will be hit the hardest, making supply chain security one of the biggest threats of 2026
Post summary
The tweet announces a PoC for CVE‑2025‑32433 via a linked blog, with no evidence of exploitation, patches, or technical specifics in the text.
#ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2021-44228 (CVSS: 10) #Apache Softw... CVE-2021-44228 (CVSS: 10) Apache Softw... CVE-2025-32433 (CVSS: 10) erlang CVE-2026-100382 (CVSS: 10) Wikimedia Fo... CVE-2026-97163 (CVSS: 10) https://lomart.fr ..🧵👇
CVE-2025-32433
Post summary
The text only references the CVE identifier CVE‑2025‑32433 without providing any additional information about disclosure, exploitation, or remediation.
🛡️ #ExploitGrid Daily Threat Digest Critical Exploits disclosed today: CVE-2021-44228 CVE-2025-24813 CVE-2025-32433 CVE-2026-32604 CVE-2024-30804 ..🧵👇
Post summary
The post serves as a daily threat digest header listing five CVE identifiers (including future-dated ones) without providing technical details, exploitation status, patches, or proof-of-concept references.
@CyberRacheal For those that say port 22, you might want to review CVE-2025-32433, CVE-2024-6387, CVE-2025-61984. Need to review version and patch levels and you still might be vulnerable. Remote access should be frontended with a private VPN. Yes I am paranoid.
Post summary
The post reminds readers to review patch status for CVE-2025-32433, CVE-2024-6387, and CVE-2025-61984 and to use a private VPN, but does not provide a PoC, exploit code, or evidence of active exploitation.
💀 CRITICAL Exploits Trending ├ CVE-2021-44228 (Log4Shell) · 2 PoCs live, 4+ years old and still active ├ CVE-2025-32433 · Erlang · PoC live ├ CVE-2026-100382 · MediaWiki · PoC live └ CVE-2026-97163 · Joomla (https://lomart.fr) · PoC live +339 more tracked today.
[EXPLOIT] CVE-2025-32433 [CRITICAL/PoC] CVSS: 10 | Vendor: #erlang Reproduce-CVE-2025-32433 🔗 https://exploitgrid.net/exploits/dbeb5110-a09e-448d-925f-d3f939688a0e
💀 CRITICAL Exploits Trending ├ CVE-2021-44228 (Log4Shell) · 2 PoCs live, still going strong 4+ years later ├ CVE-2025-32433 · Erlang · PoC live ├ CVE-2026-100382 · MediaWiki · PoC live └ CVE-2026-97163 · Joomla (https://lomart.fr) · PoC live
[EXPLOIT] CVE-2025-32433 [CRITICAL/PoC] CVSS: 10 | Vendor: #erlang Reproduce-CVE-2025-32433 🔗 https://exploitgrid.net/exploits/dbeb5110-a09e-448d-925f-d3f939688a0e
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2021-44228 CVE-2021-44228 CVE-2025-32433 CVE-2026-100382 CVE-2026-97163 ..🧵👇
[EXPLOIT] CVE-2025-32433 [CRITICAL/PoC] CVE-2025-32433-LAB 🔗 https://exploitgrid.net/exploits/6866171d-8dd0-494b-9d0e-c63616c8c371
Post summary
The text explicitly references CVE-2025-32433 as [CRITICAL/PoC], indicating a Proof of Concept is associated. No functional exploit, active exploitation, or patch information is provided in the tweet text.
[EXPLOIT] EGE-GH-EjpQM0Q [CRITICAL/PoC] Linked: CVE-2025-3243, CVE-2025-32433 CVE-2025-3243 🔗 https://exploitgrid.net/exploits/04f5ed1c-9f92-4e95-8e28-e010f831ef99
Post summary
The post announces a critical PoC for CVE‑2025‑3243, providing a link to a functional exploit on ExploitGrid, but offers no evidence of active exploitation, patching, or in‑depth technical details.
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-GH-z2Wb7PG ( CVE-2026-72898 ) EGE-GH-UkSJfvx ( CVE-2026-73678 ) EGE-GH-MKUk78n ( CVE-2023-22621 ) EGE-GH-EjpQM0Q ( CVE-2025-3243, CVE-2025-32433 ) EGE-GH-seDm3r2 ( CVE-2025-55182 ) ..🧵👇
Post summary
The post simply lists several CVE identifiers associated with daily exploit disclosures without additional context or details.
🚨 CVE-2025-32433: Critical 10.0 CVSS Erlang/OTP SSH Server Pre-Auth RCE https://www.youtube.com/watch?v=ve0cQbiamuo #Cybersecurity #Infosec #AppSec #RCE #Erlang #OTP #SSH #CVE202532433 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/NcyvlcdIuv
Post summary
The tweet announces a critically scored pre‑authentication RCE vulnerability in Erlang/OTP SSH, links to a video likely showing a PoC, but does not supply exploit code, patch details, or evidence of active exploitation.
I just completed Erlang/OTP SSH: CVE-2025-32433 room on TryHackMe! Learn about and exploit Erlang/OTP SSH CVE-2025-32433 in a lab setup. https://tryhackme.com/room/erlangotpsshcve202532433?utm_campaign=social_share&utm_medium=social&utm_content=room&utm_source=twitter&sharerId=66457951599dd28bfb000ded #tryhackme via @tryhackme #tryhackme #Learning #Consistency
Post summary
The poster completed a TryHackMe room for the Erlang/OTP SSH CVE‑2025‑32433, offering a lab environment to learn and exploit the vulnerability.
@sckull_ CVE-2025-32433 targets Erlang/OTP (an Erlang runtime used in systems like RabbitMQ or Ejabberd), enabling RCE over SSH, likely through deserialization flaws or command injection in SSH handlers—common in OTP versions before patches. ⚠️ #Erlang #RCE
Post summary
The tweet announces CVE‑2025‑32433 as an RCE vulnerability in Erlang/OTP via SSH, likely caused by deserialization or command injection, but provides no PoC, exploit code, or patch details.
@sckull_ HackTheBox "Soulmate" is a cybersecurity challenge featuring an authentication bypass vulnerability in CrushFTP and a remote code execution (RCE) exploit in Erlang/OTP SSH via CVE-2025-32433. 🔍💻 #HackTheBox #Cybersecurity
Post summary
HackTheBox challenge highlights a CrushFTP authentication bypass and an RCE in Erlang/OTP SSH (CVE-2025-32433) but provides no PoC, exploit code, or patch information.
HackTheBox - Soulmate 💥 Authentication Bypass en CrushFTP 🚀 RCE en Erlang/OTP SSH - CVE-2025-32433 https://sckull.github.io/posts/soulmate/
Post summary
The post announces an authentication bypass leading to RCE in CrushFTP's Erlang/OTP SSH (CVE-2025-32433) and provides a link to a PoC.
If your org runs FortiGate, Cisco ASA, or exposed RDP, you are a target. patch immediately 👇 → CVE-2024-55591 — FortiOS auth bypass → CVE-2025-32433 — Erlang/OTP SSH RCE → CVE-2025-33073 — actively exploited + disable unused RDP exposure + enforce MFA on VPN + monitor for AD Group Policy changes + segment your backups from the main network The Gentlemen don't pick soft targets; they pick unprepared ones. Don't be unprepared. 🎩 #CyberSecurity #Ransomware #TheGentlemen #ThreatIntel #InfoSec #BugBounty #BlueTeam #RaaS
Post summary
The text urges immediate patching of specific FortiOS, Erlang/OTP, and another CVE (actively exploited), highlighting the need for organisations with FortiGate, Cisco ASA or exposed RDP to address these vulnerabilities promptly.
36 of 36 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cisco | cloud_native_broadband_network_gateway | - | - | - |
| App | cisco | confd_basic | - | - | - |
| App | cisco | enterprise_nfv_infrastructure_software | - | - | - |
| App | cisco | inode_manager | - | - | - |
| HW | cisco | ncs_1001 | - | - | - |
| HW | cisco | ncs_1002 | - | - | - |
| HW | cisco | ncs_1004 | - | - | - |
| OS | cisco | ncs_2000_shelf_virtualization_orchestrator_firmware | - | - | - |
| HW | cisco | ncs_2000_shelf_virtualization_orchestrator_module | - | - | - |
| App | cisco | network_services_orchestrator | - | - | - |
| App | cisco | optical_site_manager | - | - | - |
| HW | cisco | rv160 | - | - | - |
| OS | cisco | rv160_firmware | - | - | - |
| HW | cisco | rv160w | - | - | - |
| OS | cisco | rv160w_firmware | - | - | - |
| HW | cisco | rv260 | - | - | - |
| OS | cisco | rv260_firmware | - | - | - |
| HW | cisco | rv260p | - | - | - |
| OS | cisco | rv260p_firmware | - | - | - |
| HW | cisco | rv260w | - | - | - |
| OS | cisco | rv260w_firmware | - | - | - |
| HW | cisco | rv340 | - | - | - |
| OS | cisco | rv340_firmware | - | - | - |
| HW | cisco | rv340w | - | - | - |
| OS | cisco | rv340w_firmware | - | - | - |
| HW | cisco | rv345 | - | - | - |
| OS | cisco | rv345_firmware | - | - | - |
| HW | cisco | rv345p | - | - | - |
| OS | cisco | rv345p_firmware | - | - | - |
| App | cisco | smart_phy | - | - | - |
| OS | cisco | staros | - | - | - |
| App | cisco | ultra_cloud_core | - | - | - |
| App | cisco | ultra_packet_core | - | - | - |
| App | cisco | ultra_services_platform | - | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| App | erlang | erlang\/otp | - | - | - |