# OpenBSD vulnerabilities & exploitation

> As of 2026-11-09, Threadlinqs tracks 5 OpenBSD CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 5 tracked threat campaigns.

**Data as of:** 2026-11-09

## Exploitation timeline

Threadlinqs has recorded 5 OpenBSD CVEs published between 2017-02-15 and 2026-11-15. The busiest month was 2026-06 (2 new CVEs). None of them is listed in CISA KEV yet.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked OpenBSD CVEs.

- [CVE-2023-48795](https://intel.threadlinqs.com/cve/CVE-2023-48795) — MEDIUM 5.9 · EPSS 93.5% · 2023-12-18
- [CVE-2016-6210](https://intel.threadlinqs.com/cve/CVE-2016-6210) — MEDIUM 5.9 · EPSS 88.9% · 2017-02-13
- [CVE-2026-123158](https://intel.threadlinqs.com/cve/CVE-2026-123158) — HIGH 8.1 · EPSS 1% · 2026-11-05
- [CVE-2026-55706](https://intel.threadlinqs.com/cve/CVE-2026-55706) — MEDIUM 5.8 · EPSS 0.2% · 2026-06-17
- [CVE-2026-57589](https://intel.threadlinqs.com/cve/CVE-2026-57589) — HIGH 7.4 · EPSS 0.2% · 2026-06-25

## Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 2 distinct OpenBSD products are affected. The most frequently affected:

- Openssh — 3 CVEs
- OpenBSD — 2 CVEs

## Threat activity

5 tracked threat campaigns reference OpenBSD products or exploit OpenBSD CVEs:

- [Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)](https://intel.threadlinqs.com/threat/TL-2026-5479) — CRITICAL — 2026-11-07
- [OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")](https://intel.threadlinqs.com/threat/TL-2026-5338) — CRITICAL — 2026-11-05
- [OpenBSD 8.0 Released With PF Firewall Hardening and Critical Vulnerability Fixes (incl. IPsec AES-GMAC Kernel Heap Overflow Erratum 003, CVE-2026-31912)](https://intel.threadlinqs.com/threat/TL-2026-4490) — MEDIUM — 2026-10-26
- [OpenBSD 7.9 Root Exploit ("Big Fish") Chaining 37-Year-Old shmat(4) Integer Overflow with sysvipc Kernel Use-After-Free (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-3770) — HIGH — 2026-10-16
- [CVE-2026-55706: 27-Year-Old OpenBSD sppp(4) PAP Authentication Bypass in sppp_pap_input()](https://intel.threadlinqs.com/threat/TL-2026-0881) — MEDIUM — 2026-06-17

## How to prioritise OpenBSD patching

This order follows the data Threadlinqs holds for OpenBSD, not a generic severity checklist:

- No OpenBSD CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are [CVE-2023-48795](https://intel.threadlinqs.com/cve/CVE-2023-48795) (93.5%), [CVE-2016-6210](https://intel.threadlinqs.com/cve/CVE-2016-6210) (88.9%), [CVE-2026-123158](https://intel.threadlinqs.com/cve/CVE-2026-123158) (1%).
- 0 CVEs score Critical and 2 High on CVSS v3 (maximum 8.1, average 6.6); sequence these after KEV and high-EPSS items.
- 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-09 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/openbsd
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting OpenBSD products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp