Microsoft Rates OpenSSH for Windows Use-After-Free Flaw as Critical
A critical remote code execution vulnerability in OpenSSH for Windows allows network-based attacks, according to new Microsoft and NVD records.
Key points
- CVE-2026-97816 is a use-after-free flaw in OpenSSH for Windows
- The vulnerability carries a critical CVSS 9.8 score
- Attackers can execute code over a network without authorization
Microsoft has classified a remote code execution flaw in its OpenSSH implementation for Windows as critical. The vulnerability, identified as CVE-2026-97816, allows unauthorized attackers to execute arbitrary code over a network by exploiting a use-after-free error.
The National Vulnerability Database records the flaw with a CVSS score of 9.8. Microsoft’s Security Update Guide confirms that the issue is a use-after-free vulnerability in OpenSSH for Windows. The advisory states that this flaw allows an unauthorized attacker to execute code over a network.
Context and Background
This announcement follows recent critical ratings for other Windows components. As Threat Times reported on October 14, 2026, Microsoft rated a heap-based buffer overflow in Windows Text Shaping as critical. That separate flaw, CVE-2026-83770, also allows remote code execution and earned a CVSS 9.8 score.
The current OpenSSH vulnerability involves a use-after-free weakness, categorized under CWE-416. The source material identifies this specific weakness type in the NVD record. Both the Microsoft advisory and the NVD description cite "use after free" as the root cause of the remote code execution capability.
Who Is Affected
The advisory specifically identifies OpenSSH for Windows as the affected component. This service is commonly used for secure remote administration of Windows servers and workstations. Any system running the vulnerable version of OpenSSH for Windows is potentially at risk from network-based attacks.
Microsoft has not specified which exact versions of the software are vulnerable in the provided summary. The affected field in the NVD record is empty. Organizations relying on OpenSSH for Windows should verify their current installations against the latest vendor guidance.
What should you do?
Microsoft has not confirmed the availability of a patch or update in the provided source material. Until a fix is released, organizations should monitor for official advisories from Microsoft. Administrators should review their network segmentation policies to limit exposure to untrusted networks.
What to do and how to stay safe: Microsoft
- Verify if your servers run OpenSSH for Windows and check for pending updates
- Restrict network access to SSH ports to trusted IP ranges only
- Monitor system logs for unusual authentication or execution patterns
- Prepare an incident response plan for potential remote code execution
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-97816?
It is a critical use-after-free vulnerability in OpenSSH for Windows that allows remote code execution.
How severe is this vulnerability?
The NVD rates CVE-2026-97816 as critical with a CVSS score of 9.8.
Is this related to the Windows Text Shaping flaw?
No, this is a separate issue in OpenSSH, whereas the Text Shaping flaw is CVE-2026-83770.
