Vulnerabilities in old OpenSSH versions
Every Linux server runs an SSH server, and on an old distribution it is an old OpenSSH. These are the versions the distributions ship, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentOpenSSH versions in end-of-life distributions
| OpenSSH | Ships with | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|
| 5.3p1 | CentOS 6 | 60 | 3 | 0 | Patch on order, 48 h |
| 7.2p2 | Ubuntu 16.04 | 50 | 1 | 0 | Patch on order, 48 h |
| 7.4p1 | CentOS 7, RHEL 7, Oracle Linux 7 and Amazon Linux 2 | 41 | 1 | 0 | Patch on order, 48 h |
| 7.6p1 | Ubuntu 18.04 | 40 | 1 | 0 | Patch on order, 48 h |
| 7.9p1 | Debian 10 | 39 | 1 | 0 | Patch on order, 48 h |
| 8.0p1 | CentOS 8 | 35 | 1 | 0 | Patch on order, 48 h |
| 8.2p1 | Ubuntu 20.04 | 36 | 1 | 0 | Patch on order, 48 h |
| 8.4p1 | Debian 11 | 34 | 1 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where OpenSSH itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Package versions from each distribution's public repositories. Distribution builds include some vendor fixes; your assessment shows which risks are real.
End-of-life Linux
The distributions behind these versions, what else they still run, and when their support ended. End-of-life Linux
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans