Servers and applications
CVE-2025-32433
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid…
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 9 Jun 2025.
- Severity
- Critical 10.0
- Published
- 16 Apr 2025
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 16 Oct 2026
- Fixed in
- 25.3.2.20, 26.2.5.11, 27.3.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp |
|
Known exploited
- CISA name
- Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 30 Jun 2025
- Used in ransomware
- Not known