Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
Security updates
10.0.17763.9376 — https://support.microsoft.com/help/5126651
10.0.20348.5761 — https://support.microsoft.com/help/5126655
10.0.19044.7807 — https://support.microsoft.com/help/5126657
10.0.26100.33650 — https://support.microsoft.com/help/5126646
10.0.26200.9711 — https://support.microsoft.com/help/5127648
10.0.22631.7652 — https://support.microsoft.com/help/5126653
10.0.28000.3231 — https://support.microsoft.com/help/5127646
Vulnerabilities 1
-
High 7.5
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-83754 Microsoft OpenSSH for Windows Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83754
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss