CVE-2026-60001: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-60001 is a vulnerability in OpenSSH's sshd daemon where the minimum authentication delay is not consistently enforced, facilitating brute-force attacks against SSH credentials. It affects all versions of OpenSSH before 10.4 and was publicly disclosed on July 8, 2026, following the release of OpenSSH 10.4 on July 6, 2026. The flaw was reported by the Orange Cyberdefense Vulnerability Team and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Openwall).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-307 (Improper Restriction of Excessive Authentication Attempts). In affected versions, sshd fails to consistently apply the configured minimum delay between authentication attempts in certain code paths, meaning the intended rate-limiting mechanism can be bypassed by unauthenticated remote attackers. No special privileges or user interaction are required, and the attack is network-accessible with low complexity. The fix was included in OpenSSH 10.4, as noted in the official release announcement (Openwall, GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to perform rapid, repeated authentication attempts against SSH services without being throttled by the configured minimum delay, effectively enabling brute-force or credential-stuffing attacks. While there is no direct confidentiality impact (no data is exposed by the vulnerability itself), a successful brute-force attack resulting from this bypass could lead to unauthorized access, integrity compromise, and potential availability disruption of the affected SSH service. The CVSS assessment reflects low integrity and low availability impact, with no confidentiality impact from the vulnerability alone (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as automatable. The EPSS score is approximately 0.265% (18th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing SSH servers running OpenSSH versions prior to 10.4 using tools such as Shodan, Censys, or Nmap (nmap -sV -p 22 <target>) to confirm the OpenSSH version banner.
2. Establish connection: Initiate repeated SSH authentication attempts to the target server on port 22 (or the configured SSH port).
3. Bypass rate limiting: Exploit the missing minimum authentication delay enforcement by sending authentication attempts in rapid succession — the server fails to impose the configured inter-attempt delay in certain code paths, allowing faster-than-intended credential guessing.
4. Brute-force credentials: Use tools such as Hydra, Medusa, or custom scripts to perform dictionary-based or credential-stuffing attacks at an accelerated rate, leveraging the absence of enforced delays to test large credential sets in a shorter timeframe.
5. Achieve unauthorized access: Upon successful credential match, authenticate to the SSH service and gain shell access to the target system (Openwall, Red Hat Bugzilla).

• Network: High volume of SSH connection attempts from a single or rotating set of source IP addresses to port 22 (or configured SSH port); connections with rapid successive authentication failures without observable inter-attempt delays.
• Logs: /var/log/auth.log or /var/log/secure showing large numbers of Failed password or Invalid user entries in rapid succession from the same or multiple source IPs; absence of expected delay between failed authentication log entries.
• Process: Unusual sshd child process activity corresponding to a high rate of authentication sessions being spawned and terminated in quick succession.

The primary remediation is to upgrade OpenSSH to version 10.4 or later, which fixes the authentication delay enforcement issue (Openwall). Ubuntu users should apply the patch provided in USN-8533-1, and Red Hat/Fedora users should monitor the Red Hat Bugzilla entry for package updates (Red Hat Bugzilla). As interim mitigations, administrators should implement network-level rate limiting on SSH ports, deploy tools such as fail2ban to block IPs with repeated failed authentication attempts, restrict SSH access to known IP ranges, and consider requiring public key authentication (disabling password-based authentication) to eliminate the brute-force attack surface entirely.

The vulnerability was reported by the Orange Cyberdefense Vulnerability Team and disclosed alongside the OpenSSH 10.4 release announcement by Damien Miller on the oss-security mailing list (Openwall). Security news outlets such as SecurityOnline.info covered the OpenSSH 10.4 security fixes, and the issue was tracked by Red Hat's Product Security team. Community reaction has been measured given the moderate severity and absence of active exploitation.