Which products and versions are affected by CVE-2016-10009?

Affected: Openssh (Openbsd); rootio-openssh; openssh-cavs (amazon), among others. The full list is in the CVE brief.

Is CVE-2016-10009 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2016-10009 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2016-10009?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2016-10009?

Fixed versions are available, including Openssh 7.3, Openssh 0:7.4p1-11.el7, Openssh 1:6.6p1-2ubuntu2.10.

How urgently should CVE-2016-10009 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2016-10009Openssh Vulnerability

openssh - security update

Published Sep 7, 2023 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2016-10009, DEBIAN-CVE-2016-10009, SUSE-SU-2017:0264-1, SUSE-SU-2017:0603-1, SUSE-SU-2017:0606-1, SUSE-SU-2017:0607-1, SUSE-SU-2017:0607-2, SUSE-SU-2017:0607-3, SUSE-SU-2017:1661-1, TR-23-0499, UBUNTU-CVE-2016-10009, USN-3538-1

Key Facts

Patch immediately

CVE-2016-10009 is a high-severity vulnerability (CVSS 7.3 v3.1) affecting Openssh (Openbsd), rootio-openssh, openssh-cavs (amazon) and 14 more products.
It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 37% probability of exploitation in the next 30 days.
Fixed versions are available, including Openssh 7.3, Openssh 0:7.4p1-11.el7, Openssh 1:6.6p1-2ubuntu2.10.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

7.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS (30-day exploit likelihood)

37%

Higher than 98.5% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

43/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://security.alpinelinux.org/vuln/CVE-2016-10009
advisoryhttps://security-tracker.debian.org/tracker/CVE-2016-10009
advisoryhttps://ubuntu.com/security/CVE-2016-10009
advisoryhttps://www.cve.org/CVERecord?id=CVE-2016-10009
advisoryRHSA-2017:2029
advisoryhttps://bugzilla.suse.com/1005480

Description

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

Affected Products

176 affected entries in total

Product	Affected versions	Fixed in
OpensshOpenbsd	See advisory	7.3
rootio-opensshrootio	See advisory	7.4_p1-r0
openssh-cavsamazon	See advisory	7.4p1-11.68.amzn1
openssh-clientsamazon	See advisory	7.4p1-11.68.amzn1
openssh-keycatamazon	See advisory	7.4p1-11.68.amzn1

12 more affected products in the full CVE brief

Patched Releases

Openssh

7.3, 0:7.4p1-11.el7, 1:6.6p1-2ubuntu2.10, 1:6.7p1-5+deb8u6, 1:7.2p2-4ubuntu2.4, 1:7.4p1-1, 5.3p1-124.el6_10+sp999, 6.2p2-0.40.1, 6.6p1-17.1, 6.6p1-35.1, 6.6p1-54.7.1, 7.2_p2-r3, 7.2_p2-r4, 7.2p2-66.1, 7.2p2-9.1, 7.4_p1-r0, 7.4p1-1, 7.4p1-11.68.amzn1, 7.4p1-11.el7, 7.5_p1-r8, 8.4p1-7.4

openssh-askpass

6.2p2-0.40.1, 7.4p1-11.el7

openssh-askpass-gnome

6.2p2-0.40.3, 6.6p1-17.1, 6.6p1-35.4, 6.6p1-54.7.1, 7.2p2-66.3, 7.2p2-9.1

openssh-cavs

6.6p1-17.1, 7.2p2-9.1, 7.4p1-11.68.amzn1, 7.4p1-11.el7, 8.4p1-7.4

openssh-clients

7.4p1-11.68.amzn1, 7.4p1-11.el7, 8.4p1-7.4

openssh-common

8.4p1-7.4

openssh-fips

6.6p1-17.1, 6.6p1-35.1, 6.6p1-54.7.1, 7.2p2-66.1, 7.2p2-9.1, 8.4p1-7.4

openssh-helpers

6.6p1-17.1, 6.6p1-35.1, 6.6p1-54.7.1, 7.2p2-66.1, 7.2p2-9.1, 8.4p1-7.4

openssh-keycat

7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-ldap

7.4p1-11.68.amzn1, 7.4p1-11.el7

openssh-openssl1

6.6p1-18.1

openssh-openssl1-helpers

6.6p1-18.1

openssh-server

7.4p1-11.68.amzn1, 7.4p1-11.el7, 8.4p1-7.4

openssh-server-sysvinit

7.4p1-11.el7

pam_ssh_agent_auth

0.10.3-1.11.68.amzn1, 0.10.3-1.11.el7

rootio-openssh

1:7.4p1-1, 7.4_p1-r0

seal-openssh

5.3p1-124.el6_10+sp999

Timeline

Publicly disclosed
Sep 7, 2023
Last updated
Aug 4, 2026

Weakness Type

CWE-426 Untrusted Search Path

References

advisorysecurity.alpinelinux.org · CVE-2016-10009
advisorysecurity-tracker.debian.org · CVE-2016-10009
advisoryubuntu.com · CVE-2016-10009
advisorycve.org · CVERecord
advisoryRHSA-2017:2029

15 more references in the full CVE brief

FAQ

Common Questions.

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
Affected: Openssh (Openbsd); rootio-openssh; openssh-cavs (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Openssh 7.3, Openssh 0:7.4p1-11.el7, Openssh 1:6.6p1-2ubuntu2.10.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2016-10009 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.