Is CVE-2026-77375 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77375?

CVE-2026-77375 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-77375

Description

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.