Skip to content
Fencer Vulns
medium 4.3

CVE-2025-32728 json

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation...

published 2025-04-10 19 mo ago modified 2026-10-15 25 d ago also EUVD-2025-10504 , GHSA-26mg-p594-q328 , JLSEC-2026-73

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

Patch / fix

  • julia OpenSSH_jll 10.0.1+0
  • OpenBSD OpenSSH 10.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssh Debian 12 1:9.2p1-2+deb12u6
  • openssh Debian 14, Debian 13 1:10.0p1-1

debian advisories DEBIAN-CVE-2025-32728

  • openssh Ubuntu 20.04 LTS 1:8.2p1-4ubuntu0.13
  • openssh Ubuntu 22.04 LTS 1:8.9p1-3ubuntu0.13
  • openssh Ubuntu 24.04 LTS 1:9.6p1-3ubuntu13.11
  • openssh Ubuntu 25.10 1:9.9p1-3ubuntu3.1
  • openssh Ubuntu Pro FIPS-updates 20.04 LTS 1:8.2p1-4ubuntu0.fips.0.13
  • openssh Ubuntu Pro FIPS-updates 22.04 LTS 1:8.9p1-3ubuntu0.13+Fips1
  • openssh Ubuntu Pro FIPS-updates 24.04 LTS 1:9.6p1-3ubuntu13.12+Fips1

ubuntu advisories UBUNTU-CVE-2025-32728

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssh RHEL 10.1 9.9p1-11.el10
  • openssh-keycat RHEL 10.1 9.9p1-11.el10
  • openssh-server RHEL 10.1 9.9p1-11.el10
  • openssh-askpass RHEL 10.1 9.9p1-11.el10
  • openssh-clients RHEL 10.1 9.9p1-11.el10
  • openssh-keysign RHEL 10.1 9.9p1-11.el10

red hat advisories RHSA-2025:20126

  • openssh Linux Micro 6.0 9.6p1-6.1
  • openssh SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 9.6p1-150600.6.26.1
  • openssh-askpass-gnome SLE Module for Desktop Applications 15 SP7, SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 9.6p1-150600.6.26.1
  • openssh SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +16 more 8.4p1-150300.3.49.1
  • openssh-askpass-gnome SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +9 more 8.4p1-150300.3.49.1

suse advisories SUSE-SU-2026:23249-1SUSE-SU-2025:01638-2SUSE-SU-2025:01638-1SUSE-SU-2025:1576-1

  • openssh openSUSE Tumbleweed 10.0p2-2.1

opensuse advisories openSUSE-SU-2025:15091-1

  • openssh AlmaLinux 10 9.9p1-11.el10.alma.1
  • openssh-keycat AlmaLinux 10 9.9p1-11.el10.alma.1
  • openssh-server AlmaLinux 10 9.9p1-11.el10.alma.1
  • openssh-askpass AlmaLinux 10 9.9p1-11.el10.alma.1
  • openssh-clients AlmaLinux 10 9.9p1-11.el10.alma.1
  • openssh-keysign AlmaLinux 10 9.9p1-11.el10.alma.1

almalinux advisories ALSA-2025:20126

  • openssh Rocky Linux 10 9.9p1-11.el10.rocky.0.1

rocky linux advisories RLSA-2025:20126

  • openssh Alpine 3.24, Alpine 3.23, Alpine 3.22 10.0_p1-r0

alpine advisories ALPINE-CVE-2025-32728

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssh CBL-Mariner 2.0 8.9p1-8
  • openssh Azure Linux 3.0 9.8p1-4

azure linux advisories AZL-59775AZL-59888

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-32728 updated cvss 4.3

openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding

  • Red Hat Enterprise Linux 6 openssh, openssh-ldap, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_auth Red Hat Enterprise Linux 7 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +3 more Red Hat Enterprise Linux 8 openssh, openssh-cavs, openssh-ldap, openssh-keycat, openssh-server, openssh-askpass, +2 more Red Hat Enterprise Linux 9 openssh, openssh-keycat, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_auth Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “To mitigate this vulnerability, explicitly disable X11 and agent forwarding in your SSH configuration (sshd_config) using: X11Forwarding no AllowAgentForwarding no”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9
    under investigation
  • Red Hat Enterprise Linux AppStream (v. 10) openssh-askpass 9.9p1-11.el10, openssh-keysign 9.9p1-11.el10 Red Hat Enterprise Linux BaseOS (v. 10) openssh 9.9p1-11.el10, openssh-keycat 9.9p1-11.el10, openssh-server 9.9p1-11.el10, openssh-clients 9.9p1-11.el10
    fixed: vendor fix “To mitigate this vulnerability, explicitly disable X11 and agent forwarding in your SSH configuration (sshd_config) using: X11Forwarding no AllowAgentForwarding no” RHSA-2025:20126

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
OSV 3.1 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
julia OpenSSH_jll
<10.0.1+0
10.0.1+0

Affected products

  • OpenBSD OpenSSH
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-440 Expected Behavior Violation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.