CVE-2026-60002: OpenBSD OpenSSH

Critical severity, CVSS 9.4. EPSS: 0.3% chance of exploitation in the next 30 days.

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

Affected products

• OpenBSD OpenSSH: before 10.4 (fixed in 10.4)

Published 2026-07-08. Last modified 2026-07-09.