CVE-2026-55200 libssh2 Exploit Harness Artifacts on Disk

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•11

Detects the execution of known exploit harnesses and proof-of-concept scripts related to CVE-2026-55200, a critical pre-authentication heap out-of-bounds write vulnerability in libssh2. The rule monitors for the execution of binaries and Python scripts identified as part of the libpwn exploit toolkit used to trigger the vulnerability.