OpenBSD Makers of OpenBSD operating system, LibreSSL and OpenSSH

Known Exploited OpenBSD Vulnerabilities

The following OpenBSD vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2020-7247: OpenSMTPD Remote Code Execution Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 21 vulnerabilities in OpenBSD with an average score of 4.8 out of ten. Last year, in 2025 OpenBSD had 12 security vulnerabilities published. That is, 9 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.73

Recent OpenBSD Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-56101	Sep 08, 2026	OpenBSD TKIP MIC Failure Countercheck Inversion: DoS via RF OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.	Openbsd
CVE-2026-73283	Aug 11, 2026	OpenSSH <10.5: restrict keyword fails to block tunnel forwarding in sshd In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.	OpenSSH
CVE-2026-73282	Aug 11, 2026	OpenSSH <10.5 UAF via Concurrent Remote-Forwarding (CVE-2026-73282) In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.	OpenSSH
CVE-2026-73281	Aug 11, 2026	SSH-AGENT Performs Remote Ops in OpenSSH <10.5 (session-bind) In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.	OpenSSH
CVE-2026-60002	Jul 08, 2026	OpenSSH <=10.3 Use-After-Free via Host Key Change (ssh) ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)	OpenSSH
CVE-2026-60001	Jul 08, 2026	OpenSSH sshd min auth delay bypass before 10.4 sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.	OpenSSH
CVE-2026-60000	Jul 08, 2026	OpenSSH <10.4 GSSAPI MaxAuthTries DoS sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.	OpenSSH
CVE-2026-59999	Jul 08, 2026	OpenSSH<10.4 DisableForwarding fails to block PermitTunnel In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.	OpenSSH
CVE-2026-59998	Jul 08, 2026	OpenSSH sshd GSSAPIStrictAcceptorCheck Misconfig Pre-10.4 on AD sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.	OpenSSH
CVE-2026-59997	Jul 08, 2026	OpenSSH <=10.3 internal-sftp accepts only first 9 args internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.	OpenSSH