CVE-2026-55200 Malicious SSH Server Scaffold - Non-Standard Port with Anomalous Cipher Negotiation

Ethan Andrews@eandrews

•updated Jun 28, 2026•2•0•8

Detects outbound SSH connections to TCP port 2222 that exhibit specific cipher negotiation patterns (curve25519-sha256 and chacha20-poly1305@openssh.com) associated with a known malicious SSH server exploit scaffold for CVE-2026-55200. This vulnerability involves a pre-authentication heap out-of-bounds write in libssh2 clients.