CVE-2026-60001 OpenBSD CVE debrief

Who should care

System administrators and security teams responsible for OpenSSH installations should be aware of this issue and take steps to ensure their systems are updated to a version that addresses the authentication delay vulnerability. This includes reviewing OpenSSH configurations and authentication mechanisms to ensure system security.

Technical summary

The sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay, potentially allowing for brute-force attacks. This issue has a CVSS score of 6.5 and is classified as MEDIUM severity. The vulnerability impacts OpenSSH installations, and updating to version 10.4 or later is recommended to address the authentication delay issue. Affected product deployments should be reviewed for exposure, and compensating controls may be necessary while remediation is scheduled and verified. System administrators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Defensive priority

Medium priority should be given to updating OpenSSH to version 10.4 or later to address this authentication delay issue.

Recommended defensive actions

• Inventory OpenSSH installations and verify versions
• Update OpenSSH to version 10.4 or later
• Monitor for potential brute-force attacks on OpenSSH
• Review OpenSSH configurations and authentication mechanisms
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Evidence is limited; primary official records indicate an authentication delay issue in OpenSSH before 10.4. Further investigation and verification are recommended. The CVE record was published on 2026-07-08T01:16:29.290Z and has not been modified since then. Additional review of OpenSSH configurations and authentication mechanisms may be necessary to ensure system security.

Official resources