CVE-2026-35387

CVSS 3.1: 6.5 medium
EPSS: <1%p15
Published: Apr 2, 2026 · Apr 2, 2026
Modified: Jul 24, 2026

Analyze CVE-2026-35387 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Vendors: openbsd

Products: openssh

Weakness: CWE-670

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news

2 stories

Debian 13.5 point release lands with security fixes, bug patches

Help Net SecurityMay 18, 00:00 UTC · May 18, 2026VulnerabilityCVE-2026-23918 CVE-2026-24072 CVE-2026-33006+144 · 1 read

USN-8804-1: OpenSSH vulnerabilities

Ubuntu patched two OpenSSH flaws, including command execution on 14.04 and an ECDSA bypass.

Ubuntu Security NoticesSep 22, 14:24 UTC · Sep 22, 2026AdvisoryCVE-2026-35386 CVE-2026-353873