Skip to content
fr Sign in
10.0 Critical Exploited

CVE-2025-32433 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns Not observed so far
Weakness CWE-306

Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Affected products and versions

Product Affected versions Fixed in
otp Versions not published

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of otp

The 64 CVEs of otp →
CVE-2026-96596 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm… 5.9 Medium CVE-2026-105236 Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a… 6.3 Medium CVE-2026-94200 Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and… 8.2 High CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated… 8.2 High
Track this CVE