CVE-2023-48795: SSH Terrapin attack downgrades channel integrity in OpenSSH and many SSH implementations

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw affects a very large set of SSH implementations, has a high EPSS probability and public exploit discussion, though it requires a network man-in-the-middle position and only degrades integrity.

What it is

The SSH transport protocol with certain OpenSSH extensions mishandles the handshake and sequence numbers, letting a remote attacker omit packets from the extension negotiation message. This can downgrade or disable security features on the connection, an issue known as the Terrapin attack. It affects OpenSSH before 9.6 and a long list of other SSH clients, servers and libraries.

Impact

An attacker positioned in the network path can weaken or disable integrity protections on the SSH channel, allowing some packets to be omitted without detection. This undermines the integrity of the connection rather than directly granting code execution or credential theft.

Attack surface

Reachable over the network by an attacker who can intercept or modify SSH traffic between client and server; no authentication or user interaction is required per the CVSS vector. Exploitation depends on the connection using vulnerable extension negotiation and affected cipher or MAC algorithms such as [email protected] or CBC with Encrypt-then-MAC.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.933 (99.8th percentile), and public references include press coverage, mailing list discussion and a Packet Storm advisory. No ransomware group use is documented in the record.

What to do

• Patch OpenSSH to 9.6 or later and update every listed affected SSH client, server and library to its fixed release.
• If immediate patching is not possible, disable the vulnerable [email protected] cipher and CBC Encrypt-then-MAC algorithms, or apply the strict KEX / Terrapin countermeasure where the product supports it.
• Inventory SSH implementations across clients, servers, appliances and embedded devices, since the affected list is broad and includes third-party libraries.
• Restrict SSH exposure to trusted networks and monitor for unexpected SSH connection resets or negotiation anomalies.

Detection

• Monitor SSH server and client logs for handshake failures, unexpected disconnects or negotiation errors that could indicate Terrapin-style manipulation.
• Track SSH software versions in use and alert on any endpoint still running a version below the fixed release.
• Use network monitoring to detect SSH connections negotiating [email protected] or CBC Encrypt-then-MAC where policy forbids them.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.