Red Hat Security Advisory

RHSA-2026:66410

openssh security update

Released 2026-09-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.6) openssh-askpass-8.7p1-45.el9_6.4, pam_ssh_agent_auth-0.10.4-5.45.el9_6.4
Red Hat Enterprise Linux BaseOS EUS (v.9.6) openssh-8.7p1-45.el9_6.4, openssh-clients-8.7p1-45.el9_6.4, openssh-keycat-8.7p1-45.el9_6.4 +1

TI-2026-42784 CVE-2026-60002 · GHSA-gp5v-jg37-fvg6

MEDIUM 42

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.003 Published 2026-07-08 Partial fix · 10.4 CWE-416