CVE-2024-43581: Microsoft OpenSSH for Windows RCE Vulnerability

CVE-2024-43581 Overview

CVE-2024-43581 is a remote code execution vulnerability in Microsoft OpenSSH for Windows. The flaw affects the Windows implementation of the OpenSSH service across supported Windows 10, Windows 11, and Windows Server editions. Microsoft assigned the weakness to CWE-73: External Control of File Name or Path, indicating that attacker-influenced path handling contributes to exploitation. Successful exploitation requires user interaction and low-privilege access, but grants high impact to confidentiality, integrity, and availability. Microsoft published the advisory on October 8, 2024, as part of its Patch Tuesday cycle.

Critical Impact
An authenticated attacker who convinces a user to complete a specific interaction can execute arbitrary code on Windows systems running the OpenSSH server, compromising the host in full.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2) across x64 and ARM64
Microsoft Windows Server 2019, Server 2022, and Server 2022 23H2

Discovery Timeline

2024-10-08 - Microsoft publishes advisory for CVE-2024-43581
2024-10-08 - CVE-2024-43581 published to the NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43581

Vulnerability Analysis

The vulnerability resides in the Microsoft port of OpenSSH bundled with modern Windows and Windows Server releases. Microsoft classifies the issue under CWE-73, which covers external control of file name or path. That weakness class allows an attacker to influence a file path that the service later resolves, opens, or executes.

Exploitation is network-based but not trivial. The advisory requires user interaction and low-privilege access on the target, and the attack complexity is high. In practical terms, an attacker typically needs an authenticated SSH context or a controlled interaction with the OpenSSH service before the path-handling flaw can be reached.

Once triggered, the condition leads to arbitrary code execution in the context of the OpenSSH service. On Windows, sshd typically runs with NT AUTHORITY\SYSTEM or a dedicated service account, giving code execution significant host-level reach.

Root Cause

The root cause is improper control over a file name or path that is derived from external input. When the OpenSSH server processes this input, it resolves or accesses a resource the attacker can influence, enabling code execution outside the intended trust boundary.

Attack Vector

The attack vector is network. An attacker interacts with the OpenSSH service on TCP port 22 (default) and leverages a user-interaction step to satisfy the exploitation preconditions. No verified public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is published for this issue. Refer to the Microsoft Security Update Guide entry for CVE-2024-43581 for authoritative technical details.

Detection Methods for CVE-2024-43581

Indicators of Compromise

Unexpected child processes spawned by sshd.exe, particularly cmd.exe, powershell.exe, or scripting hosts under the OpenSSH service account.
New or modified files in OpenSSH configuration paths such as %ProgramData%\ssh\ and %ProgramFiles%\OpenSSH\.
Anomalous SSH sessions from unfamiliar source addresses immediately preceding local process creation or persistence artifacts.

Detection Strategies

Monitor Windows Event Log channel OpenSSH/Operational for authentication events, session establishment, and abnormal error patterns.
Alert on sshd.exe creating processes outside the expected shell surface, especially binaries loaded from user-writable paths.
Correlate SSH login events with subsequent file-system and registry changes on the same host to surface post-authentication abuse.

Monitoring Recommendations

Enable Sysmon Event IDs 1 (process create), 11 (file create), and 3 (network connect) with sshd.exe in scope.
Track outbound connections initiated by processes whose parent is sshd.exe, which typically indicates hands-on-keyboard activity or tool staging.
Baseline normal SSH usage per host and flag deviations in source IP, user account, and session duration.

How to Mitigate CVE-2024-43581

Immediate Actions Required

Apply the October 2024 security updates from Microsoft to every affected Windows 10, Windows 11, and Windows Server host running OpenSSH.
Inventory systems where the OpenSSH Server optional feature is installed and prioritize internet-exposed hosts.
Restrict inbound TCP/22 to trusted management networks using Windows Defender Firewall or perimeter controls.

Patch Information

Microsoft released fixes on October 8, 2024. Consult the Microsoft Security Update Guide entry for CVE-2024-43581 for the KB article and package IDs matching each Windows build. Install the cumulative update associated with your OS version and reboot to complete servicing.

Workarounds

Disable the OpenSSH Server feature on hosts that do not require it using Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.
Enforce key-based authentication and disable password authentication in sshd_config to reduce the pool of accounts an attacker can leverage.
Constrain SSH access with AllowUsers, AllowGroups, and network-layer ACLs limiting source addresses.

bash

# Disable OpenSSH Server where not required
Get-Service sshd | Stop-Service
Set-Service -Name sshd -StartupType Disabled
Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

# Restrict inbound SSH to a management subnet
New-NetFirewallRule -DisplayName "Restrict SSH" -Direction Inbound `
  -Protocol TCP -LocalPort 22 -RemoteAddress 10.0.10.0/24 -Action Allow