CVE-2026-73281: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

CSIRTS triage

What: SSH agent allows remote operations intended to be local-only due to session-bind extension mishandling.
Who is affected: Systems running OpenSSH versions before 10.5 with ssh-agent in use are affected.
Urgency: Low severity with CVSS 3.5; remediation can follow standard patch cycles.
Action: Upgrade to OpenSSH 10.5 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch OpenSSH

Get an email when a new OpenSSH advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-732810.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2026-73281	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.