CVE-2026-48851

What it actually does

PuTTY versions 0.77 through 0.83 mishandle the trust indicator used for TELNET data when a proxy authentication phase occurs before the main TELNET session. The client displays a copied PuTTY icon as an indication of trusted TELNET data, but the trust state is not cleared correctly when transitioning from proxy authentication to the actual remote session. A malicious or compromised TELNET endpoint, proxy, or network-positioned attacker able to influence the session flow may cause untrusted session content to appear with a misleading trust indication. The primary impact is limited integrity degradation in the user interface: users may be tricked into trusting terminal data or prompts that should not be considered trusted.

Why it matters to the business

This issue could enable social-engineering-style deception during interactive TELNET use, potentially causing an operator to trust misleading prompts or session output. The operational risk is highest where PuTTY is used for TELNET connections through proxies to administer legacy systems, network devices, lab systems, or industrial/embedded equipment. The severity and public exploitation likelihood are low based on the supplied CVSS score, EPSS value, lack of known exploited status, and no known mature exploit, but the flaw should still be remediated because PuTTY is widely used and the affected versions span multiple releases.

How an attack unfolds

An attacker first needs a user to initiate an interactive TELNET connection using an affected PuTTY version, typically in a workflow involving proxy authentication before the final TELNET session. The attacker must then control or influence the proxy authentication exchange, the TELNET server, or traffic visible to the user. By exploiting the client’s failure to clear the prior trust status when the session transitions from proxy authentication to the main TELNET session, the attacker can cause subsequent TELNET data to be presented with a misleading trust indication. The attacker’s practical goal is not code execution; it is to make terminal output, prompts, or instructions appear more trustworthy than they are, increasing the chance that a user follows attacker-controlled instructions, enters sensitive commands, or discloses information during the session.

How to fix it

Upgrade PuTTY to version 0.84 or later. If immediate upgrade is not possible, reduce exposure by avoiding TELNET where possible, using SSH instead of TELNET, avoiding proxy-mediated TELNET sessions from affected PuTTY versions, and limiting TELNET access to trusted networks and known endpoints. Organizations that distribute PuTTY through software catalogs, golden images, jump boxes, admin workstations, or portable tool bundles should update those packages as well, because older standalone copies of putty.exe may persist outside normal package-management workflows.

How to confirm the fix worked

Confirm that all installed and portable PuTTY binaries report version 0.84 or later. On Windows, check the file properties for putty.exe and related PuTTY tools, search common user download/tool directories for older copies, and validate software inventory records. Where TELNET is still required, confirm users are not using PuTTY 0.77 through 0.83 for proxy-mediated TELNET connections. As a functional validation, reproduce representative TELNET-through-proxy workflows using the updated client and confirm that trust indicators do not persist incorrectly across the proxy authentication and main session transition.

Typical attack path

1. Identify users or workflows that use PuTTY 0.77 through 0.83 for TELNET connections, especially through a proxy requiring authentication.
2. Position as, compromise, or control a TELNET server or proxy involved in the user’s connection path, or otherwise influence the interactive session content.
3. Wait for or induce the user to connect with the vulnerable PuTTY client.
4. Manipulate the proxy-authentication-to-session transition so the client fails to clear the trust indication state.
5. Display crafted TELNET content, prompts, or instructions that appear more trustworthy to the user than they should.
6. Rely on the user to take an unsafe action, such as entering commands, sharing information, or accepting misleading session output.

How to detect it

There are no reliable universal indicators that prove this flaw was exploited, because the vulnerability affects client-side trust presentation rather than creating a distinctive file, process, registry key, or network artifact. To assess possible prior exploitation, review endpoint telemetry for execution of PuTTY 0.77 through 0.83, especially sessions using TELNET and proxy configuration. Correlate those sessions with proxy logs, firewall logs, network device logs, and TELNET server logs for unusual destinations, unexpected proxy-authentication events, abnormal interactive activity, or administrator actions shortly after a TELNET connection. If terminal session recording is available, review sessions for suspicious banners, prompts, unexpected instructions, or misleading content presented immediately after proxy authentication. Treat any anomalous commands entered by users during affected TELNET sessions as potential downstream evidence of successful deception rather than direct proof of exploitation.

What your security team should do

• Inventory PuTTY deployments, including portable executables stored in user profiles, shared tool folders, jump hosts, and administrator workstations.
• Upgrade all PuTTY installations and bundled copies to version 0.84 or later.
• Prioritize remediation for users who connect to TELNET services through proxies or administer sensitive legacy/network systems interactively.
• Discourage TELNET use and migrate workflows to SSH or other encrypted, authenticated protocols wherever feasible.
• Restrict TELNET access to trusted management networks and known hosts until affected clients are upgraded.
• Educate administrators that terminal banners, prompts, or trust-like UI indicators should not be treated as proof that session content is safe.
• Monitor for continued execution of PuTTY versions 0.77 through 0.83 after the upgrade campaign.