CVE-2025-26465 & CVE-2025-26466 Vulnerabilities Expose Systems to Man-in-the-Middle and DoS Attacks

Two newly uncovered security flaws in the open-source OpenSSH suite tracked as CVE-2025-26465 and CVE-2025-26466 could enable adversaries to launch machine-in-the-middle/man-in-the-middle (MitM) or denial-of-service (DoS) attacks. 

With the growing number of weaponized CVEs, proactive detection of vulnerability exploitation is more critical than ever. In just the first two months of 2025, 6,127 new vulnerabilities have been listed by NIST NVD, making this a high-risk period for cyber defenders.

To spot potential attacks against your organization on time, SOC Prime Platform for collective cyber defense curates a large set of Sigma rules aimed at vulnerability exploitation detection. Hit the Explore Detections button below and immediately drill down to a relevant stack of context-enriched detections backed by a complete product suite for automated threat hunting, AI-powered detection engineering, and intelligence-led threat detection. By checking our Sigma rules library by the CVE tag, you won’t miss the emerging threats potentially challenging your business as detections are added on a daily basis. 

Explore Detections

All the rules are compatible with multiple SIEM, EDR, and Data Lake solutions and are mapped to the MITRE ATT&CK framework to smooth out threat investigation. Additionally, detections are enriched with detailed metadata, including CTI references, attack timelines, triage recommendations, and more.

CVE-2025-26465 and CVE-2025-26466 Analysis

The Qualys TRU team shed light on two OpenSSH vulnerabilities tracked as CVE-2025-26465 and CVE-2025-26466. The former, with a CVSS score reaching 6.8, enables a MitM attack on the client when VerifyHostKeyDNS is active, while the latter impacts both client and server, allowing a pre-authentication DoS attack. 

Notably, if exploited, CVE-2025-26465 could allow a MitM attack in which the client mistakenly accepts the attacker’s key as legitimate, compromising the SSH connection’s integrity and enabling interception or tampering without the user’s awareness. The VerifyHostKeyDNS option is disabled by default but was enabled on FreeBSD from September 2013 to March 2023, posing potential risks. Meanwhile, repeated exploitation of CVE-2025-26466 could disrupt server availability, blocking admins and users alike. 

OpenSSH versions 6.8p1–9.9p1 are vulnerable to CVE-2025-26465, while the product versions 9.5p1–9.9p1 can be exposed to CVE-2025-26466. To timely remediate CVE-2025-26466 and CVE-2025-26465, defenders recommend updating to the OpenSSH 9.9p2 version, which patches both flaws. Rely on SOC Prime Platform to enhance your organization’s cybersecurity posture against ever-expanding attack surface while maximizing resource effectiveness.