CVE-2025-32433: Unauthenticated RCE in Erlang/OTP SSH

Erlang/OTP SSH critical RCE without authentication (CVSS 10.0). Patches immediately available for three versions.

CVE-2025-32433 describes a flaw in SSH message handling within Erlang/OTP. An unauthenticated attacker can exploit it to execute arbitrary code on affected systems. Erlang/OTP is a widely deployed platform for distributed and telecommunications applications; its SSH server is present in many enterprise environments.

The vulnerability scores CVSS 10.0 (critical). It was published by NVD on April 16, 2025, affecting versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. Signals from public GitHub repositories, updated November 3, 2026, show the topic continues to generate interest from the security research community.

Immediate priority is updating Erlang/OTP to patched versions. Pending the patch, disable the SSH server or restrict access via firewall rules to reduce attack surface. Review SSH access logs for suspicious attempts. Consult infrastructure teams to identify exposed systems.

At a glance

What: Flaw in Erlang/OTP SSH protocol allowing unauthenticated remote code execution (CVE-2025-32433)
Severity: CVSS 10.0, critical
Affected versions: OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20 and earlier versions
Fix: Update to patched versions: OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20 or later
Status: Vulnerability confirmed (NVD published April 16, 2025); GitHub signals today indicate active interest
Action: Highest priority: inventory systems with Erlang/OTP SSH; apply patches; if not possible, disable SSH or restrict access via firewall

Sources: NVD, CVE-2025-32433

← All articles