CVE-2026-60060 TeraTerm Project CVE debrief

Who should care

Users of Tera Term and TTSSH2 plugin, administrators, and security teams should be aware of this vulnerability and take necessary actions to protect themselves. They should review their exposure, verify affected scope, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The TTSSH2 plugin of Tera Term is vulnerable to Improper Handling of Length Parameter Inconsistency (CWE-130). When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpectedly or terminate abnormally. The vulnerability is considered Medium priority due to the potential for unexpected behavior or abnormal termination of Tera Term.

Defensive priority

Medium priority due to the potential for unexpected behavior or abnormal termination of Tera Term.

Recommended defensive actions

• Update TTSSH2 plugin to the latest version
• Use secure SSH connections
• Monitor Tera Term for unexpected behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-17T05:16:41.360Z and has not been modified since then. The NVD entry is currently Received. The TTSSH2 plugin of Tera Term is vulnerable to Improper Handling of Length Parameter Inconsistency (CWE-130). When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpectedly or terminate abnormally. Users and administrators should verify their exposure and review vendor guidance for updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.