Home › CVE Intelligence › CVE-2026-62325
CVSS 9.8 CRITICAL Vulnerability

CVE-2026-62325: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix. CVE-202…

9.8CVSS Score
CRITICALSeverity
NOCISA KEV
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-62325
VendorMultiple Vendors
Affected ProductMultiple Products
Vulnerability TypeVulnerability
CVSS Score9.8 (CRITICAL)
Actively Exploited❌ No known exploitation
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

#

Summary

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

#

CVE-2026-40884

CVE-2026-40884 (GHSA-c29w-qq4m-2gc... [Full analysis available on Pro]

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-62325 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence