CVE-2026-55200 libssh2 RCE PoC Artifacts and Exploit Harness Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•11

Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.