CVE-2026-79762 Termix-SSH CVE debrief

Who should care

Defenders responsible for Termix deployments, including system administrators and security teams, should assess exposure and take action to secure their environments. This includes verifying the current version of Termix, reviewing user access and authentication, and monitoring for potential decryption of stored sensitive data. Additionally, defenders should prioritize verifying exposure and upgrading to version 2.5.1 or later, as well as reviewing and Sec

Why it matters

CVE-2026-79762 allows decryption of stored sensitive data in Termix deployments due to weak key derivation. Defenders should prioritize verifying exposure and upgrading to version 2.5.1 or later.

• Decrypt stored SSH passwords, private keys, and passphrases
• Verify exposure and upgrade to version 2.5.1 or later
• Review and secure Termix deployments

Technical summary

Termix, a web-based server management platform, derives data encryption keys from default strings and userId salts in versions 1.7.0 to 2.5.1. Without configured OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET, an attacker with an offline SQLite database copy can derive wrapping keys, recover users' DEKs, and decrypt stored SSH passwords, private keys, and passphrases. The issue is fixed in version 2.5.1.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 2.5.1 or later, as well as reviewing and securing their Termix deployments.

Recommended defensive actions

• Verify Termix version and upgrade to 2.5.1 or later if necessary
• Review and secure Termix deployments, including reviewing user access and authentication
• Monitor for potential decryption of stored sensitive data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is based on official CVE Program and NVD records, as well as source references from [email protected]. The records indicate that the issue is fixed in version 2.5.1, but do not provide information on exploitation or affected users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.