CVE-2026-69397

CVE-2026-69397 is a use-after-free (CWE-416) vulnerability in the OpenSSH implementation shipped for Windows, assigned by Microsoft. Triggering requires a network-reachable condition plus user interaction and favorable timing (CVSS: AV:N/AC:H/PR:N/UI:R), which is consistent with an attacker having to induce a user or service into an SSH connection under attacker-controlled conditions before the freed memory is reused. A successful exploit allows an unauthorized attacker to execute arbitrary code on the target with the impact scored as high across confidentiality, integrity, and availability. Any Windows system using the bundled OpenSSH components is potentially affected, with the exact affected version ranges not stated in the available data. Exploitation status is currently quiet: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.6% probability of exploitation within 30 days.

What to do: Track Microsoft's advisory and apply the patched OpenSSH for Windows version as soon as it is released, prioritizing internet-facing Windows servers with the OpenSSH Server optional feature enabled. As interim mitigation, disable or remove the built-in OpenSSH client/server on systems that do not need it, and restrict inbound SSH exposure with firewall rules. Because no public PoC exists yet, verify vendor guidance on whether the flaw lies in the client or server component before tuning which hosts to remediate first.