CVE-2026-48852

What it actually does

PuTTY versions before 0.84 can hit an assertion failure while verifying an ECDSA signature during SSH protocol processing. A remote peer that can present a specially crafted ECDSA signature, such as a malicious SSH server or an attacker able to intercept and manipulate an SSH connection, may cause the vulnerable PuTTY-family client process to abort. The known impact is limited to availability: the affected client session terminates unexpectedly, with no indicated confidentiality or integrity loss.

Why it matters to the business

This vulnerability can disrupt SSH-based administration, file transfer, and automation that relies on vulnerable PuTTY tools such as PuTTY, Plink, PSCP, or PSFTP. The severity is relatively low because exploitation is denial-of-service only, has high attack complexity, and current EPSS probability is low, but it can still interrupt operations if administrators or scripts connect to hostile, spoofed, or compromised SSH endpoints. It is not listed in CISA KEV and is not currently associated with ransomware campaigns in the provided data.

How an attack unfolds

An attacker first needs to be in a position where a vulnerable PuTTY client will process attacker-controlled SSH signature material. This could be achieved by operating a malicious SSH server, compromising a legitimate SSH server, or performing a network interception that allows manipulation of SSH handshake messages. During connection setup, the attacker supplies a malformed or edge-case ECDSA signature that reaches PuTTY's ECDSA signature verification logic. Vulnerable versions before 0.84 encounter an internal assertion failure instead of safely rejecting the signature, causing the client process to terminate. The attacker gains no code execution or data access from the flaw itself, but can repeatedly crash affected client sessions or automation that reconnects to the malicious endpoint.

How to fix it

Upgrade all PuTTY-family tools to PuTTY 0.84 or later. This includes interactive PuTTY as well as related utilities such as Plink, PSCP, PSFTP, Pageant, and any bundled or redistributed PuTTY binaries. Where immediate upgrade is not possible, reduce exposure by avoiding connections to untrusted SSH servers, enforcing strict host key verification, preventing DNS or routing manipulation, and replacing vulnerable PuTTY-based automation with a patched client. Because no per-package fixed version list was provided, use the upstream fixed release indicated by the advisory: 0.84 or later.

How to confirm the fix worked

Confirm that every installed or bundled PuTTY-family executable reports version 0.84 or later. On Windows, check the executable properties, vendor package inventory, endpoint management software, or run the tool with version/help options where supported. Validate that automation paths reference the upgraded binaries and not older copies in user directories, tool bundles, archives, or application folders. Where feasible, test connections to known-good SSH servers using ECDSA host keys and confirm sessions complete normally. Review software inventory for PuTTY versions 0.71 through 0.83 and treat them as vulnerable.

Typical attack path

1. Identify users, scripts, or tools using PuTTY-family clients older than 0.84.
2. Place an attacker-controlled SSH endpoint in the connection path, such as a malicious server, compromised server, DNS-spoofed destination, or man-in-the-middle position.
3. Initiate or wait for a vulnerable PuTTY client to connect to the attacker-controlled SSH service.
4. Send crafted ECDSA signature data during SSH handshake or signature verification processing.
5. Trigger the assertion failure in the vulnerable client.
6. Cause the PuTTY-family process and active SSH session to terminate.

How to detect it

To assess whether this was already exploited, look for unexplained crashes of PuTTY-family processes during SSH connection setup, especially when connecting to new, untrusted, recently changed, or externally hosted SSH endpoints. Relevant sources include Windows Application event logs, Windows Error Reporting entries, endpoint detection telemetry, crash dump directories, shell histories, task scheduler logs, automation job logs, PuTTY session logs if enabled, SSH client wrapper logs, DNS logs, proxy/firewall logs for outbound SSH, and network captures around TCP port 22. Focus on repeated process termination of putty.exe, plink.exe, pscp.exe, or psftp.exe with timing correlated to SSH handshakes. Because the vulnerability causes a client-side assertion failure rather than server compromise, expected artifacts are application crashes, failed automation runs, abnormal reconnect loops, and possibly crash dumps referencing assertion failure or ECDSA signature verification. There are no reliable public indicators of specific threat actor exploitation in the provided data.

• Faulting application name: putty.exe
• Faulting application name: plink.exe
• Faulting application name: pscp.exe
• Faulting application name: psftp.exe
• putty.exe
• plink.exe
• pscp.exe
• psftp.exe
• PuTTY Fatal Error
• Assertion failed
• assertion failure
• ECDSA signature verification
• Windows Error Reporting
• AppCrash_putty.exe
• AppCrash_plink.exe
• AppCrash_pscp.exe
• AppCrash_psftp.exe

What your security team should do

• Inventory all PuTTY-family binaries across endpoints, jump hosts, administrator workstations, and automation servers.
• Prioritize upgrading PuTTY, Plink, PSCP, PSFTP, and bundled copies to version 0.84 or later.
• Search endpoint and application logs for repeated PuTTY-family crashes, especially during SSH connection establishment.
• Identify scripts or scheduled tasks that depend on vulnerable PuTTY utilities and update their binary paths.
• Harden SSH usage by enforcing trusted host key verification and discouraging connections to unknown SSH servers.
• Monitor for suspicious DNS, proxy, or routing changes that could redirect SSH clients to attacker-controlled endpoints.
• Because exploitation likelihood is currently low and the flaw is denial-of-service only, handle through normal patch cycles unless PuTTY is heavily used for operational automation.