CVE-2025-32728

What it actually does

The DisableForwarding directive in sshd fails to block X11 and agent forwarding as documented, allowing these forwarding mechanisms to remain active despite explicit configuration to disable them.

Why it matters to the business

Organizations relying on DisableForwarding to restrict remote session capabilities may inadvertently permit unauthorized forwarding channels, increasing exposure in environments with strict access controls; low exploit probability and no known active campaigns reduce immediate urgency but patching remains necessary for compliance.

How an attack unfolds

An attacker with valid SSH access to a system configured with DisableForwarding connects and requests X11 or agent forwarding; because the directive is not enforced, the server permits the forwarding session, bypassing the intended restriction.

How to fix it

Upgrade OpenSSH to version 10.0 or later; apply commit fc86875e6acb36401dfc1dfb6b628a9d1460f367 in portable builds; Red Hat Enterprise Linux 7 Thunderbird users should update to 60.8.0-1.el7_6 or newer packages that incorporate the corrected OpenSSH dependency.

How to confirm the fix worked

Confirm sshd version is 10.0 or newer, verify the DisableForwarding directive now correctly blocks X11 and agent forwarding in test connections, and audit sshd_config files for the directive presence after upgrade.

Typical attack path

1. Obtain valid credentials or access to an SSH account on the target system
2. Issue an SSH connection request that includes X11 or agent forwarding options
3. Server accepts the forwarding request despite DisableForwarding being set
4. Use the established forwarding channel for lateral movement or credential theft

How to detect it

No historical exploitation artifacts are known; monitor SSH authentication and session logs for unexpected X11 or agent forwarding requests on systems with DisableForwarding enabled.

What your security team should do

• Prioritize upgrade of all OpenSSH instances to 10.0+ within standard change windows given low EPSS and absence from KEV
• Review sshd_config files across the environment to ensure DisableForwarding is applied where intended
• Test forwarding behavior post-upgrade before enforcing in production