Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

Security teams are on high alert following the release of a public proof-of-concept exploit for a critical vulnerability in libssh2, a widely used client-side SSH library. The emergence of this exploit code significantly increases the urgency for organizations to address this serious flaw that could allow attackers to execute arbitrary code on systems connecting to malicious SSH servers.

CVE-2026-55200 represents a severe security weakness in the libssh2 library, which is commonly integrated into various applications for SSH client functionality. This vulnerability enables a malicious or compromised SSH server to trigger memory corruption on a connecting client system. What makes this particularly dangerous is that the attack requires no authentication credentials and no user interaction, making it an attractive target for threat actors seeking to compromise systems silently.

All versions of libssh2 up to and including version 1.11.1 are vulnerable to this attack. The vulnerability