Which products and versions are affected by CVE-2024-6387?

Affected: Active Iq Unified Manager (Netapp); E-Series Santricity OS Controller (Netapp); Ontap (Netapp) versions 9, among others. The full list is in the CVE brief.

Is CVE-2024-6387 being exploited in the wild?

It is exploited in the wild, listed in Industry KEV feed since Jul 17, 2024.

Is CVE-2024-6387 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2024-6387?

Public exploit code is available.

Is there a fix for CVE-2024-6387?

Fixed versions are available, including apple macos 12.7.6, apple macos 13.6.8, apple macos 14.6.

How urgently should CVE-2024-6387 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2024-6387

HighExploitedPublic exploit

openssh: regreSSHion - race condition in SSH allows RCE/DoS

Published Jul 2, 2024 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2024-6387, DEBIAN-CVE-2024-6387, DSA-5724-1, JLSEC-2026-71, RegreSSHion, SUSE-SU-2024:2275-1, TR-24-0846, UBUNTU-CVE-2024-6387, USN-6859-1, regreSSHion

Key Facts

Patch immediately

CVE-2024-6387 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Active Iq Unified Manager (Netapp), E-Series Santricity OS Controller (Netapp), Ontap (Netapp) and 22 more products.
It is exploited in the wild, listed in Industry KEV feed since Jul 17, 2024. Public exploit code is available.
EPSS estimates a 100% probability of exploitation in the next 30 days.
Fixed versions are available, including apple macos 12.7.6, apple macos 13.6.8, apple macos 14.6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2024-6387 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
Industry KEV feed	Jul 17, 2024	n/a	Not reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

224 affected entries in total

Product	Affected versions	Fixed in
Active Iq Unified ManagerNetapp	See advisory	n/a
E-Series Santricity OS ControllerNetapp	See advisory	11.70.2
OntapNetapp	9	n/a
Ontap Select Deploy Administration UtilityNetapp	See advisory	n/a
Ontap ToolsNetapp	10, 9	n/a

20 more affected products in the full CVE brief

Patched Releases

apple macos

12.7.6, 13.6.8, 14.6

arista eos

4.32.1f

E-Series Santricity OS Controller

11.70.2

netbsd

10.0.0

OpenSSH

4.4, 0:8.7p1-12.el9_0.1, 0.10.4-5.38.el9_4.1, 1:8.9p1-3ubuntu0.10, 1:9.2p1-2+deb12u3, 1:9.6p1-3ubuntu13.3, 1:9.7p1-7, 8.7p1-38.0.2.el9, 8.7p1-38.0.2.el9_4.1, 8.7p1-8.amzn2023.0.11, 8.9p1-6, 8.9p1-8.ph4, 9.1_p1-r6, 9.3_p2-r2, 9.3p2-9.ph5, 9.6_p1-r1, 9.6p1-10.1, 9.6p1-150600.6.3.1, 9.6p1-2.1, 9.7_p1-r4, 9.8_p1-r0, 9.8p1-1

OpenSSH_jll

9.9.1+0

openssh-askpass

8.7p1-38.0.2.el9, 8.7p1-38.0.2.el9_4.1

openssh-askpass-gnome

9.6p1-150600.6.3.1

openssh-cavs

9.6p1-10.1, 9.6p1-150600.6.3.1

openssh-clients

8.7p1-38.0.2.el9, 8.7p1-38.0.2.el9_4.1, 8.7p1-8.amzn2023.0.11, 8.9p1-8.ph4, 9.3p2-9.ph5, 9.6p1-10.1, 9.6p1-150600.6.3.1, 9.6p1-2.1

openssh-common

9.6p1-10.1, 9.6p1-150600.6.3.1, 9.6p1-2.1

openssh-fips

9.6p1-10.1, 9.6p1-150600.6.3.1, 9.6p1-2.1

openssh-helpers

9.6p1-10.1, 9.6p1-150600.6.3.1

openssh-keycat

8.7p1-38.0.2.el9, 8.7p1-38.0.2.el9_4.1, 8.7p1-8.amzn2023.0.11

openssh-server

8.7p1-38.0.2.el9, 8.7p1-38.0.2.el9_4.1, 8.7p1-8.amzn2023.0.11, 8.9p1-8.ph4, 9.3p2-9.ph5, 9.6p1-10.1, 9.6p1-150600.6.3.1, 9.6p1-2.1

openssh-server-config-disallow-rootlogin

9.6p1-150600.6.3.1

openssh-server-config-rootlogin

9.6p1-10.1, 9.6p1-2.1

openssh-socket

8.9p1-8.ph4, 9.3p2-9.ph5

pam_ssh_agent_auth

0.10.4-4.8.amzn2023.0.11, 0.10.4-5.38.0.2.el9, 0.10.4-5.38.0.2.el9_4.1

rhcos

413.92.202407091321-0

rootio-openssh

1:9.2p1-2+deb12u3, 1:9.7p1-7, 9.3_p2-r2

Timeline

Publicly disclosed
Jul 2, 2024
Added to Industry KEV feed
Jul 17, 2024
Last updated
Oct 16, 2026

Weakness Type

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-364 Signal Handler Race Condition

References

15 more references in the full CVE brief

FAQ

Common Questions.

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
Affected: Active Iq Unified Manager (Netapp); E-Series Santricity OS Controller (Netapp); Ontap (Netapp) versions 9, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jul 17, 2024.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including apple macos 12.7.6, apple macos 13.6.8, apple macos 14.6.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2024-6387 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.