Is CVE-2016-1908 being actively exploited?

CVE-2016-1908 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2016-1908?

CVE-2016-1908 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2016-1908

CRITICAL · CVSS 9.8EPSS 13.7%EU EUVD

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-287
EPSS score: 13.7% (96th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2016-2999)
Published: April 11, 2017
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-2999 in the EU Vulnerability Database. Last updated in EUVD on May 29, 2026.

View on the EU Vulnerability Database

Affected products

debian / debian linux
openbsd / openssh
oracle / linux
oracle / linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux workstation
redhat / enterprise linux workstation

Certified products that may be affected

26 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Oracle Linux 7 NSS Cryptographic Module - Oracle Corporation - FIPS 140 4586 - historical
Oracle Linux 7 Libreswan Cryptographic Module - Oracle Corporation - FIPS 140 4266 - historical
Oracle Linux 7 OpenSSH Client Cryptographic Module - Oracle Corporation - FIPS 140 4206 - historical
Oracle Linux 7 OpenSSH Server Cryptographic Module - Oracle Corporation - FIPS 140 4176 - historical
Oracle Linux 7 Unbreakable Enterprise Kernel (UEK 6) Cryptographic Module - Oracle Corporation - FIPS 140 4169 - historical

See all 26 in the Security Certifications Explorer.

References

http://openwall.com/lists/oss-security/2016/01/15/13(Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0465.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0741.html(Third Party Advisory)
http://www.openssh.com/txt/release-7.2(Release Notes, Vendor Advisory)
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Third Party Advisory)
http://www.securityfocus.com/bid/84427(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1034705(Broken Link, Third Party Advisory, VDB Entry)
https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c(Patch, Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1298741(Issue Tracking, Patch, Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html(Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/201612-18(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain