Microsoft OpenSSH for Windows: Denial of Service through unlimited resource allocation

Summary

Microsoft's OpenSSH for Windows allocates resources without limits or throttling (CWE-770). A remote, unauthenticated attacker can exhaust these resources and disrupt the SSH service. Only availability is affected, and exposure depends on whether the Windows OpenSSH server is enabled and reachable over the network.

Affected

• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2019, including Server Core (builds below 10.0.17763.9376)
• Windows Server 2022 (builds below 10.0.20348.5761)
• Windows Server 2025, including Server Core (builds below 10.0.26100.33650)

Note: The NVD CPE lists only Windows 10 1809. The vendor record lists the products above.

Fixed in

• Install Microsoft's security update of October 2026 for the affected Windows version.
• Minimum fixed builds: 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025).
• Verify builds and KB numbers in the MSRC advisory before deployment.

Workaround

Unknown. No vendor workaround was found. Reduce exposure by limiting access to the SSH port to management networks and by disabling the OpenSSH server service where it is not needed.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Not listed in the CISA KEV catalogue.
• EPSS 0.01105.
• No public proof of concept or exploit was found. This does not rule one out.

Our recommendation

• Patch affected Windows hosts with the October 2026 security update, starting with internet-facing servers that run the OpenSSH server.
• Check whether the OpenSSH server feature is installed and enabled on each host, and whether it is reachable from untrusted networks.
• Restrict SSH access with firewall rules and disable the service where it is not needed.
• Check the support status of Windows 10 1809 and plan an upgrade if it is out of support.
• Monitor SSH service availability and logs for unusual connection floods.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide msrc.microsoft.com
• Vulners Microsoft advisory mirror vulners.com
• Vulners CVE list record vulners.com
• OpenCVE app.opencve.io
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:05.