Vulnerability in OpenSSH (July 1, 2024)

unknownCVE-2024-6387

On July 1, 2024, OpenSSH published a security advisory regarding the critical vulnerability CVE-2024-6387. This vulnerability allows an unauthenticated attacker to execute arbitrary code remotely with *root* privileges. The vendor specifies that versions 8.5p1 to 9.7p1 are...

CSIRTS triage

vendor: OpenSSH product: OpenSSH Remote code executionaffected: 8.5p1 to 9.7p1

What: The vulnerability allows an unauthenticated attacker to execute arbitrary code remotely with root privileges.
Who is affected: All OpenSSH installations using versions 8.5p1 to 9.7p1.
Urgency: Remediation is urgent due to the critical nature of the vulnerability.
Action: Upgrade to a version outside the affected range.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch OpenSSH

Get an email when a new OpenSSH advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2024-07-01
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-009/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2024-6387EPSS puts this in the most-targeted tier (99.5% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-6387	coverage & exploitation status	NVD · CVE.org

Recent advisories for OpenSSH

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] OpenSSH: Multiple vulnerabilitiescert-bund · 2026-07-10
medium[UPDATE] [medium] OpenSSH: Multiple vulnerabilitiescert-bund · 2026-07-09
highCVE-2026-47829: Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH …nvd · 2026-07-09
medium[UPDATE] [medium] OpenSSH: Multiple vulnerabilitiescert-bund · 2026-07-08
highCVE-2026-60002: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during…nvd · 2026-07-08
mediumCVE-2026-60001: sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.nvd · 2026-07-08