wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

Cybersecuritynews •Abinaya • October 8, 2026

wolfSSL has released wolfSSH 1.6.0 to fix five security flaws, including a critical host key verification bypass that could let an attacker impersonate an SSH server. Published on October 6, 2026, the update addresses Windows privilege escalation, unauthenticated key exchange abuse, unauthorized forwarding channels, and an SFTP memory corruption bug. The release rates one flaw […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

wolfSSH 1.6.0 Addresses Critical SSH Authentication Bypass Vulnerability wolfSSL has released wolfSSH version 1.6.0 to patch five security vulnerabilities, including a critical SSH host-key authentication bypass identified as CVE-2026-16516. This flaw allows a man-in-the-middle attacker to impersonate an SSH server by exploiting insufficient verification of ECDSA host-key authenticity. The vulnerability affects wolfSSH versions up to 1.5.0 and has a CVSS score of 9.0. Additionally, the update addresses a high-severity Windows privilege escalation flaw (CVE-2026-83540) and three medium-severity issues related to Diffie-Hellman key exchange and unauthorized TCP forwarding. The vulnerabilities were disclosed on October 6, 2026, and the patches are now available for affected systems. 2 sources 71

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)