regreSSHion OpenSSH Flaw Exposes Servers to Unauthenticated Root RCE
Active Exploitation · 5 sources · Updated 2mo ago · First seen Jul 22, 2025
A critical flaw in OpenSSH server, tracked as CVE-2024-6387 and dubbed regreSSHion, can allow an unauthenticated attacker to achieve remote code execution with root privileges under specific conditions. The issue affects OpenSSH versions 8.5p1 through 9.7p1, and public reporting says it has been actively exploited in the wild with proof-of-concept code available. Researchers and national defenders also highlighted related issues, including CVE-2024-6409, a less severe code-execution variant identified during analysis, and CVE-2024-7589, a FreeBSD-specific variant patched separately.
Defenders were urged to upgrade to OpenSSH 9.8p1 or later to remove exposure. Where immediate patching is not possible, guidance recommends temporarily restricting or disabling SSH access, or setting LoginGraceTime to 0 as a mitigation, while warning that this workaround can disrupt service availability and should be treated as temporary until systems are fully updated.
