Is CVE-2026-77185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77185 being exploited in the wild.

How severe is CVE-2026-77185?

Critical severity, with a CVSS score of 9.1, published 30 September 2026.

Which products and versions are affected?

Apache MINA SSHD 2.0.0 to 2.19.0, 3.0.0-M1 to 3.0.0-M5.

Is there a fix for CVE-2026-77185?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77185 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77185?

Check whether you run Apache MINA SSHD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77185: Apache MINA SSHD authentication bypass in asynchronous authentication

CVE-2026-77185 · Severity: critical · CVSS 9.1 · Published 2026-09-30

Apache MINA SSHD is a Java library used to build SSH servers. A flaw in its asynchronous authentication feature allows attackers to bypass public-key or hostbased signature verification, potentially enabling unauthorized access to SSH servers that implement this mechanism. This could allow an attacker to authenticate without valid credentials on affected systems.

Technologies: Apache MINA SSHD. Vendors: Apache.

Quick answers

Is CVE-2026-77185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77185 being exploited in the wild.
How severe is CVE-2026-77185?: Critical severity, with a CVSS score of 9.1, published 30 September 2026.
Which products and versions are affected?: Apache MINA SSHD 2.0.0 to 2.19.0, 3.0.0-M1 to 3.0.0-M5.
Is there a fix for CVE-2026-77185?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77185 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77185?: Check whether you run Apache MINA SSHD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the asynchronous authentication mechanism of MINA SSHD's server implementation, where signature validation is improperly handled or skipped for public-key and hostbased authentication schemes. An attacker with network access can exploit this by providing invalid or missing signatures during authentication. The flaw is fixed in versions 2.20.0 and 3.0.0-M6, which also restrict asynchronous authentication to password and keyboard-interactive methods only.

Affected products

Apache MINA SSHD 2.0.0 to 2.19.0, 3.0.0-M1 to 3.0.0-M5

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.