CVE-2026-60060: Tera Term Information Disclosure Bug

CVE-2026-60060 Overview

CVE-2026-60060 is an Improper Handling of Length Parameter Inconsistency vulnerability [CWE-130] in the TTSSH2 plugin of Tera Term, maintained by the TeraTerm Project. When Tera Term initiates an SSH connection to a server controlled by an attacker, the client performs out-of-bounds read and write operations. The flaw allows adjacent memory contents to be transmitted to the attacker-controlled server. It can also cause Tera Term to behave unexpectedly or terminate abnormally.

Critical Impact
A malicious SSH server can trigger out-of-bounds memory access in the Tera Term client, leaking contents of adjacent memory regions and causing abnormal termination of the client process.

Affected Products

Tera Term (TTSSH2 plugin)
TeraTerm Project distributions incorporating the vulnerable TTSSH2 component
SSH client sessions established from Tera Term to untrusted servers

Discovery Timeline

2026-07-17 - CVE-2026-60060 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-60060

Vulnerability Analysis

The vulnerability resides in the TTSSH2 plugin, which implements SSH client functionality for Tera Term. The plugin processes length parameters received from the SSH server without ensuring consistency between the declared length and the actual buffer capacity. When a malicious server sends a crafted SSH message with mismatched length fields, the TTSSH2 code performs read or write operations that cross buffer boundaries.

Out-of-bounds reads expose adjacent memory contents, which the client may then transmit back to the attacker-controlled server. Out-of-bounds writes corrupt process memory and can cause abnormal termination. The attack requires user action, as the victim must initiate an SSH connection to the attacker's server.

Root Cause

The root cause is improper handling of length parameter inconsistency [CWE-130]. TTSSH2 trusts length fields supplied by the remote SSH server without validating them against the size of local buffers or the actual amount of data received. This missing validation permits the parser to operate on memory regions outside the intended buffer.

Attack Vector

Exploitation is network-based but requires user interaction. The victim must connect from Tera Term to an SSH server operated by the attacker. Once the SSH handshake or subsequent protocol exchange begins, the malicious server returns messages containing inconsistent length values that trigger the out-of-bounds access. Attackers may deliver the target server address through phishing, misleading documentation, or configuration tampering.

No verified public proof-of-concept code is available for CVE-2026-60060. Refer to the Tera Term Security Advisory (EN) and the JVN #65294474 Advisory for protocol-level technical details.

Detection Methods for CVE-2026-60060

Indicators of Compromise

Unexpected termination or crashes of the ttermpro.exe process shortly after establishing an SSH session
Outbound SSH sessions from workstations to unfamiliar or newly registered domains and IP addresses
SSH client processes generating Windows Error Reporting entries referencing the TTSSH2 plugin
Anomalous outbound TCP/22 traffic volume from user endpoints running Tera Term

Detection Strategies

Monitor endpoint telemetry for Tera Term process crashes correlated with outbound SSH connection attempts
Inspect DNS and network logs for SSH connections to servers outside the approved administrative inventory
Alert on Tera Term binaries loading the TTSSH2 plugin followed by short-lived network sessions and process exits
Correlate user-initiated SSH sessions with reputation data on destination hosts

Monitoring Recommendations

Enforce logging of all outbound SSH connections from managed endpoints and forward events to a central SIEM
Track version metadata of installed Tera Term binaries across the fleet to identify unpatched clients
Baseline normal SSH destinations per user or team and alert on deviations to unknown external servers

How to Mitigate CVE-2026-60060

Immediate Actions Required

Inventory all endpoints running Tera Term and identify installations that include the TTSSH2 plugin
Restrict Tera Term usage to SSH connections targeting known, trusted internal servers
Educate administrators to avoid connecting Tera Term to SSH endpoints from untrusted sources or unverified documentation
Apply the fixed version distributed by the TeraTerm Project as soon as it is available in your change window

Patch Information

The TeraTerm Project has published details and remediation guidance in the Tera Term Security Advisory and its English translation. Additional coordination information is available through the JVN #65294474 Advisory. Upgrade Tera Term to the version identified as fixed in the vendor advisory.

Workarounds

Avoid initiating SSH connections from Tera Term to servers whose identity and integrity cannot be verified
Use SSH host key pinning and verify server fingerprints before completing the handshake to reduce exposure to attacker-controlled endpoints
Where feasible, route Tera Term SSH traffic through an SSH bastion that only permits connections to approved destination hosts
Restrict outbound TCP/22 at the network perimeter to an allowlist of known administrative targets

bash

# Configuration example: restrict outbound SSH to an allowlist on Windows endpoints
New-NetFirewallRule -DisplayName "Block outbound SSH except allowlist" `
  -Direction Outbound -Protocol TCP -RemotePort 22 `
  -Action Block -Profile Any

New-NetFirewallRule -DisplayName "Allow SSH to bastion" `
  -Direction Outbound -Protocol TCP -RemotePort 22 `
  -RemoteAddress 10.10.0.10 -Action Allow -Profile Any