CVE-2026-97811: OpenSSH Windows Privilege Escalation

CVE-2026-97811 Overview

CVE-2026-97811 is a double free vulnerability in OpenSSH for Windows that enables local privilege escalation. An authorized attacker with low-privilege access to a vulnerable host can trigger the flaw to execute code in a higher security context. The weakness maps to [CWE-400] resource management handling and affects the Windows port of OpenSSH maintained by Microsoft. Microsoft published the advisory through the Microsoft Security Update Guide.

Critical Impact
Local attackers with valid credentials can elevate to SYSTEM-level privileges on affected Windows hosts running OpenSSH, compromising confidentiality, integrity, and availability.

Affected Products

OpenSSH for Windows (Microsoft distribution)
Windows Server instances with OpenSSH Server feature enabled
Windows client editions with OpenSSH Server component installed

Discovery Timeline

2026-10-13 - CVE-2026-97811 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97811

Vulnerability Analysis

The vulnerability is a double free condition in the OpenSSH for Windows service. A double free occurs when the same memory region is released twice through free() or an equivalent deallocation call. The second deallocation corrupts heap allocator metadata, which an attacker can shape to influence subsequent allocations.

Because OpenSSH on Windows runs with elevated service privileges, successful exploitation permits code execution in a higher-privilege security context than the attacker initially holds. The flaw requires local access and valid low-privilege credentials, consistent with the local attack vector and low privileges required by the advisory metrics.

Root Cause

The root cause is improper lifecycle management of a heap allocation within OpenSSH for Windows. A pointer is freed on one code path and then freed again on a secondary path without being nullified or re-validated. The condition is tracked under [CWE-400] in the NVD entry. Microsoft has not published the specific affected function in the public advisory.

Attack Vector

Exploitation requires an authenticated local session on the Windows host running OpenSSH. The attacker interacts with the OpenSSH service in a sequence that triggers the duplicate deallocation. Successful heap grooming can lead to arbitrary code execution within the OpenSSH service context. Remote exploitation over the network is not described by the advisory metrics, which classify the attack vector as local.

See the Microsoft Security Update Guide for additional technical details.

Detection Methods for CVE-2026-97811

Indicators of Compromise

Unexpected crashes or restarts of the sshd service on Windows hosts, often logged in the Windows Application and System event logs.
OpenSSH service processes spawning child processes such as cmd.exe, powershell.exe, or LOLBins under the SYSTEM account from unexpected session contexts.
Creation of new local administrators, scheduled tasks, or services shortly after SSH authentication events from standard user accounts.

Detection Strategies

Correlate OpenSSH authentication events in the Windows Event Log channel OpenSSH/Operational with subsequent process creation events (Event ID 4688) that show privilege elevation.
Baseline normal sshd.exe child process behavior and alert on deviations, particularly interactive shells or administrative tools launched post-authentication.
Monitor for repeated sshd.exe crashes with access violation exceptions, which may indicate exploitation attempts against the double free condition.

Monitoring Recommendations

Enable verbose OpenSSH logging and forward events to a centralized SIEM for correlation with endpoint telemetry.
Track heap corruption indicators such as Windows Error Reporting entries and crash dumps referencing sshd.exe.
Review authentication logs for low-privilege accounts initiating SSH sessions to servers where they have no business function.

How to Mitigate CVE-2026-97811

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as validated in a test environment.
Inventory all Windows hosts with the OpenSSH Server feature installed using PowerShell: Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'.
Restrict SSH access to administrative networks and jump hosts until patches are deployed.

Patch Information

Microsoft has released a security update addressing CVE-2026-97811 through its standard update channels. Consult the Microsoft Security Update Guide entry for the specific KB article, affected build numbers, and update packages. Deploy the update through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

Disable the OpenSSH Server service on hosts that do not require SSH access: Stop-Service sshd; Set-Service sshd -StartupType Disabled.
Enforce strict host-based firewall rules limiting inbound TCP/22 to trusted management subnets.
Require multi-factor authentication for all accounts permitted to authenticate over SSH to reduce the pool of attackers that can reach the vulnerable code path.

bash

# Configuration example - disable OpenSSH Server on hosts that do not require it
Stop-Service sshd
Set-Service sshd -StartupType Disabled
Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0