CVE-2026-97816: OpenSSH for Windows Use After Free Flaw

CVE-2026-97816 Overview

CVE-2026-97816 is a use-after-free vulnerability [CWE-416] in OpenSSH for Windows. An unauthenticated remote attacker can trigger the flaw over the network to execute arbitrary code on the target system. Microsoft published the advisory on October 13, 2026.

The vulnerability requires no privileges and no user interaction. Successful exploitation grants the attacker the ability to compromise confidentiality, integrity, and availability of the affected host. OpenSSH for Windows is widely deployed for remote administration, which expands the attack surface across enterprise, cloud, and developer environments.

Critical Impact
Unauthenticated remote code execution against OpenSSH for Windows services exposed on the network.

Affected Products

OpenSSH for Windows (see the Microsoft Security Response Center advisory for the specific build range)

Discovery Timeline

2026-10-13 - CVE CVE-2026-97816 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97816

Vulnerability Analysis

The flaw is a use-after-free condition in the OpenSSH for Windows service. A use-after-free occurs when a program continues to reference memory after it has been released. An attacker who controls the contents of the reallocated memory region can redirect execution flow or corrupt critical structures.

Because the vulnerable code path is reachable before authentication, an attacker can target any system exposing the SSH listener. Successful exploitation yields code execution in the context of the OpenSSH service, which commonly runs with elevated privileges on Windows hosts.

Microsoft classifies the issue under network attack vector with low complexity. Refer to the Microsoft Security Update CVE-2026-97816 advisory for the authoritative technical description.

Root Cause

The root cause is improper memory lifecycle management in OpenSSH for Windows. A pointer continues to be used after the backing object has been freed, allowing an attacker to influence subsequent memory contents and corrupt program state during the pre-authentication protocol handshake.

Attack Vector

Exploitation occurs over the network against the SSH listening port, typically TCP 22. The attacker establishes a connection and sends crafted protocol messages that trigger the use-after-free in the service process. No credentials or user interaction are required.

No verified public exploit code is available at the time of publication. See the Microsoft advisory for additional protocol-level technical details.

Detection Methods for CVE-2026-97816

Indicators of Compromise

Unexpected sshd.exe process crashes or Windows Error Reporting (WER) entries referencing access violations in the OpenSSH service.
Child processes spawned by sshd.exe that are not legitimate shell sessions, especially cmd.exe, powershell.exe, or script interpreters.
Inbound TCP 22 connections from untrusted sources followed by outbound beaconing from the host.
New or modified SSH authorized_keys files and unexpected service account activity after an inbound SSH connection.

Detection Strategies

Monitor Windows Event Logs for OpenSSH service faults, abnormal restarts, and crash dumps that align with inbound SSH traffic.
Correlate sshd.exe process ancestry with network telemetry to identify pre-authentication exploitation attempts.
Deploy network signatures that flag malformed SSH key-exchange messages reaching Windows hosts.

Monitoring Recommendations

Enable verbose OpenSSH logging and forward events to a centralized SIEM for correlation.
Baseline normal SSH client sources and alert on connections from unfamiliar networks or geographies.
Track EPSS trajectory for CVE-2026-97816 (currently 0.911%) and prioritize response if exploitation activity increases.

How to Mitigate CVE-2026-97816

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all Windows systems running OpenSSH.
Inventory all hosts with the OpenSSH Server optional feature enabled, including workstations, servers, and cloud instances.
Restrict inbound TCP 22 access to trusted management networks until patching completes.

Patch Information

Microsoft has released a security update for CVE-2026-97816. Consult the Microsoft Security Update CVE-2026-97816 advisory for the specific KB article and build numbers that remediate the vulnerability.

Workarounds

Disable the OpenSSH Server feature on hosts that do not require SSH access using Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.
Enforce host-based firewall rules that limit SSH exposure to specific administrative source IP addresses.
Front OpenSSH with a bastion or jump host that terminates untrusted connections before they reach vulnerable systems.

bash

# Configuration example: restrict inbound SSH to a management subnet
New-NetFirewallRule -DisplayName "Restrict OpenSSH to Mgmt" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 22 \
  -RemoteAddress 10.10.0.0/24 \
  -Action Allow

New-NetFirewallRule -DisplayName "Block OpenSSH Elsewhere" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 22 \
  -Action Block