Some vulnerabilities kick down the front door with a battering ram. This one has been quietly living inside your walls — tucked into libraries you didn't even remember bundling — patiently waiting for someone to notice. Everyone, say hello to CVE-2026-55200.

An Integer Overflow With Frightening Reach

Researchers disclosed a CVSS 9.2 flaw in libssh2, the widely used client-side SSH library, in which a malicious server can trigger memory corruption during the handshake and achieve code execution. It stems from an integer overflow while validating SSH handshake packets — the sort of bug that sounds tediously academic right up until it owns your machine.

The genuinely scary part is distribution. libssh2 is embedded in curl and statically linked into countless appliances, which means vulnerable copies are hiding well outside your normal package-update routine. Patching the obvious install is easy; hunting down every static copy baked into firmware and vendor gear is the stuff of security-team nightmares and cancelled weekends.

Not Alone in a Rough Week

libssh2 had plenty of company. The same briefing flagged CVE-2026-46817, a critical flaw in Oracle E-Business Suite's Payments module, alongside a PeopleSoft zero-day that attackers actually used to breach the National Association of Insurance Commissioners. NAIC says only public statutory financial data was touched — not personal or payment information — which is the corporate-disclosure equivalent of "it's just a scratch."

The good news for libssh2 specifically is that no in-the-wild exploitation has been reported yet. The bad news is that "yet" is doing an enormous amount of heavy lifting in that sentence, especially now that proof-of-concept code is already making the rounds and threat actors love a pre-written exploit.

Go audit your dependencies — all of them, including the ones curl dragged in behind your back without asking. The bug you can't see is still very much your problem, and attackers have excellent eyesight.

Source: CybersecBrief