Researchers disclosed a remote code execution flaw in OpenSSH versions 8.5–9.7 that allows unauthenticated attackers to execute arbitrary commands with root privileges.
A critical remote code execution vulnerability has been discovered in OpenSSH, tracked as CVE-2025-3841. The flaw affects versions 8.5 through 9.7 and has been confirmed on major Linux distributions.
The vulnerability exists in the pre-authentication phase of the SSH handshake. A specially crafted packet can trigger a heap buffer overflow, allowing arbitrary code execution with root privileges.
Security researchers estimate approximately 14 million internet-facing servers are running a vulnerable version. AWS, Google Cloud, and Azure have all issued advisories.
Upgrade OpenSSH to version 9.8p1 immediately. As an interim mitigation, set LoginGraceTime to 0 in your sshd_config file.
Step-by-step guide
Step 1 — Check with your host
Log into your hosting control panel and look for a Software Updates section. Apply all available updates.
Step 2 — Enable auto-updates
Enable automatic security updates so future patches are applied without manual intervention.
Original source
NVD / NIST
Share this article
No community notes yet
Be the first to add a technical insight.