CVE WatchSep 1, 2026

CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) cl

CVSS

4.3

Medium

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Published: Jun 23, 2026 · Last modified: Sep 1, 2026 · CWE-415

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-08-112026-09-07

Technical description

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-799077.8 HIG

—

———Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6h CVE-2026-819507.8 HIG

—

———Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.8h CVE-2026-800808.8 HIG

—

———Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.7h CVE-2026-775048.8 HIG

—

———Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.7h CVE-2026-774939.8 CRI

—

———Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.9h CVE-2026-729588.2 HIG

—

———Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.9h