CVE-2026-35388

LOW 2.5CVE-2026-35388 · Published 02/04/2026 · updated 24/07/2026

In short

CVE-2026-35388 is a LOW (CVSS 2.5) vulnerability affecting openssh (openbsd).
Chance of exploitation in the next 30 days (EPSS): 0.13%, higher than 2.8% of all vulnerabilities.
Fix: update to 10.3 or later.

Package	Affected versions	Patched versions
openssh openbsd	`< 10.3`	`10.3`

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 10.3

10.3

More vulnerabilities in openssh

See all →