What’s Vulnerable › Vulnerabilities

CVE-2025-32728

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-10 · updated 2026-10-15
• Weakness: CWE-440

Description

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

Affected products

• Debian Linux: 11.0
• OpenSSH: from 7.4 before 10.0 — fixed in 10.0

How to fix

Upgrade to a fixed version: OpenSSH 10.0. Check the vendor advisory for mitigations.

References

• https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig
• https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367
• https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html
• https://www.openssh.com/txt/release-10.0
• https://www.openssh.com/txt/release-7.4
• https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html
• https://security.netapp.com/advisory/ntap-20250425-0002/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2025-32728 or the next vulnerability affects your stack