Read the docs
TI-2026-68959 Aliases CVE-2026-83540GHSA-36jf-xmwg-5wp8

Logon token reuse in wolfSSHd on Windows allows privilege escalation

Priority LOW 36CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

wolfSSL wolfSSH versions from 1.4.15 through 1.5.0 affect the Windows port of wolfSSHd when password or public key authentication is used. The Windows logon token from one authenticated connection is not released before a token is acquired for the next connection, which poisons logins between connections (CWE-287). A less privileged user with a valid account on the server can force a login as a more privileged user. Non-Windows builds of wolfSSHd are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00552 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wolfSSLwolfSSH1.4.15 – 1.5.0—No fix listedCNA
  • wolfSSH VendorwolfSSL Affected 1.4.15 – 1.5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*1.4.15 to before 1.6.0VulnerablewolfSSH
  • cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:* Versions 1.4.15 to before 1.6.0 Vulnerable ·wolfSSH

Remediation

The sources list no fixed version for wolfSSH.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-83540
  2. 2026-10-07 Alias added: GHSA-36jf-xmwg-5wp8
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → LOW
  5. 2026-10-13 CVSS score added · NVD

References

Patch 2

Advisory 1

Other 1

  • TI-2024-00830 SEGV and out of bounds memory read from malicious packet CVSS 3.1CRITICAL 9.1
  • TI-2009-04246 Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp… CVSS 2.0HIGH 7.5
  • TI-2022-18557 In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3… CVSS 3.1HIGH 7.5
  • TI-2025-10943 Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello CVSS 4.0MEDIUM 6.3
  • TI-2017-09737 wolfSSL Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2019-08902 wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity… CVSS 3.1CRITICAL 9.8
See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences