Is CVE-2025-26465 in the CISA KEV catalog?

No. CVE-2025-26465 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-26465?

CVE-2025-26465 has a CVSS v3 base score of 6.8 (MEDIUM).

What is the EPSS score for CVE-2025-26465?

CVE-2025-26465 has an EPSS score of 7.45% (94th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-26465?

Upgrade openssh on debian 11 to 1:8.4p1-5+deb11u4 or later. Fixes are available for 42 affected products.

CVE & CISA-KEV Catalog

CVE-2025-26465

MEDIUMEPSS 94th pctl

6.8

CVSS v3

NVD

Description

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CWE-390

How to fix

Remediation Available

opensshDebian

Fixed in:1:8.4p1-5+deb11u4CVE-2025-26465

Fixed in:1:9.2p1-2+deb12u5CVE-2025-26465

Fixed in:1:9.9p2-1CVE-2025-26465

opensshRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

opensshRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-askpassRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-askpassRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-askpass-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-askpass-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-cavsRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavsRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavs-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-cavs-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-clientsRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-clientsRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-clients-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-clients-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-debugsourceRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-debugsourceRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-keycatRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-keycatRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-keycat-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-keycat-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-ldapRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldapRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldap-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-ldap-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

openssh-serverRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-serverRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-server-debuginfoRocky

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-server-debuginfoRed Hat / RHEL

Fixed in:0:8.0p1-26.el8_10RHSA-2025:16823

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

openssh-sk-dummy-debuginfoRocky

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

openssh-sk-dummy-debuginfoRed Hat / RHEL

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

Fixed in:0:8.7p1-38.el9_4.5RHSA-2025:3837

Fixed in:0:8.7p1-45.el9RHSA-2025:6993

pam_ssh_agent_authRed Hat / RHEL

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

pam_ssh_agent_authRocky

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

pam_ssh_agent_auth-debuginfoRed Hat / RHEL

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

pam_ssh_agent_auth-debuginfoRocky

Fixed in:0:0.10.3-7.26.el8_10RHSA-2025:16823

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

Fixed in:0:0.10.4-5.38.el9_4.5RHSA-2025:3837

Fixed in:0:0.10.4-5.45.el9RHSA-2025:6993

registry.redhat.io/discovery/discoveryRocky

Fixed in:server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64RHSA-2025:8385

Fixed in:server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64RHSA-2025:8385

registry.redhat.io/discovery/discoveryRed Hat / RHEL

Fixed in:ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64RHSA-2025:8385

Fixed in:server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64RHSA-2025:8385

Fixed in:server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64RHSA-2025:8385

Fixed in:ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64RHSA-2025:8385

opensshUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

openssh-clientUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

openssh-serverUbuntu

Fixed in:1:7.2p2-4ubuntu2.10+esm7USN-7270-2

Fixed in:1:7.6p1-4ubuntu0.7+esm4USN-7270-2

Fixed in:1:8.2p1-4ubuntu0.12USN-7270-1

Fixed in:1:8.9p1-3ubuntu0.11USN-7270-1

Fixed in:1:9.6p1-3ubuntu13.8USN-7270-1

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploit Intelligence

7.45%probability of exploitation in 30 days

94thpercentile

High risk: more likely to be exploited than 94% of all known CVEs.

References

Patch1

ftp.openbsd.org

Mitigation1

vicarius.io

Third-Party Advisory12

Issue Tracking1

bugzilla.suse.com

Release Notes1

openssh.com

Press / Media1

theregister.com

Other references10

Related Vulnerabilities

Other CWE-390 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2024-30255	Medium	5.3	88%	-	Fix
CVE-2024-27919	High	7.5	87%	-	-
CVE-2019-5051	High	8.8	4.0%	-	Fix
CVE-2021-40391	Critical	9.8	2.9%	-	Fix
CVE-2017-7485	Medium	5.9	2.0%	-	-
CVE-2024-12086	Medium	6.1	1.8%	-	Fix

Embed a live status badge for CVE-2025-26465

Markdown

[![CVE-2025-26465](https://tridentstack.com/cve/badge/CVE-2025-26465.svg)](https://tridentstack.com/cve/CVE-2025-26465)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-26465"><img src="https://tridentstack.com/cve/badge/CVE-2025-26465.svg" alt="CVE-2025-26465"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-07-14.