CVE-2025-26465
Openbsd Openssh 6.9 – 9.8
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2025-26465 is a medium-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Openbsd Openssh. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-26465 is a vulnerability in OpenSSH that arises when the VerifyHostKeyDNS option is enabled. It stems from OpenSSH's mishandling of error codes under specific conditions during host key verification, allowing a malicious machine to impersonate a legitimate server in a machine-in-the-middle (MitM) attack. The issue is classified under CWE-390 (Detection of Error Condition Without Action) and carries a CVSS v3.1 base score of 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
A remote attacker with network access can exploit this vulnerability by positioning themselves in the MitM path between the client and server. Exploitation requires user interaction, such as initiating an SSH connection, and high attack complexity, including exhausting the client's memory resources beforehand. Successful exploitation enables the attacker to impersonate the legitimate server, potentially compromising confidentiality and integrity of the SSH session.
Red Hat has issued multiple security errata addressing this vulnerability, including RHSA-2025:16823, RHSA-2025:3837, RHSA-2025:6993, and RHSA-2025:8385, with additional details available on their CVE page at https://access.redhat.com/security/cve/CVE-2025-26465. These advisories provide patches and mitigation guidance for affected systems.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4686
Vulnerability Data
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when…
more
verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation will surface code paths that detect errors yet perform no subsequent action.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Declaring incidents when criteria are met forces action on detected errors; eliminating the weakness helps but does not define the criteria themselves.
Triaging and validating reports compels follow-up on detections; removing the weakness supports but does not replace triage processes.
Analysis of detected events directly counters ignoring them, but does not guarantee every error condition is covered.
Monitoring produces detections, yet supplies no requirement to act on them.
Generating logs enables later action but does not enforce handling of each error condition.
Root-cause analysis of incidents requires acting on detected anomalies, though it applies after an incident is already declared.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover missing error handling, but does not ensure the weakness is eliminated in production code.
Logging captures error conditions but does not guarantee subsequent handling or remediation.
Monitoring activities can detect errors, yet without defined response procedures the weakness persists.
Secure development lifecycle practices encourage proper error handling, but do not mandate it for every detected condition.
Secure coding standards typically require explicit error handling, reducing the likelihood of silent failures.