Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-7750

56
FAUCET Score

CVE-2018-7750 is a critical authentication bypass vulnerability affecting Paramiko SSH server implementations across multiple versions, as well as Debian and Red Hat distributions utilizing Paramiko. An attacker can bypass authentication by crafting a customized SSH client to skip the authentication step before sending other requests. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk with network-based attacks, low complexity, and high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, a public exploit (EDB-45712) exists, though there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.17.6CPE matchmatch criteria
cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*
>= 1.18.0, < 1.18.5CPE matchmatch criteria
cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*
>= 2.0.0, < 2.0.8CPE matchmatch criteria
cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*
>= 2.1.0, < 2.1.5CPE matchmatch criteria
cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*
>= 2.2.0, < 2.2.3CPE matchmatch criteria
cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
27.07%
Probability of exploitation in next 30 days
EPSS Percentile
97.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
ExploitDB: EDB-45712 · Oct 29, 2018
This CVE's current EPSS score of 0.2707 is in the 95th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (52)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: paramikoFixed in: 2.3.2
pippatch availablevia ghsa
Product: paramikoFixed in: 2.4.1
pippatch availablevia ghsa
Product: paramikoFixed in: 1.18.5
pippatch availablevia ghsa
Product: paramikoFixed in: 1.17.6
pippatch availablevia ghsa
Product: paramikoFixed in: 2.0.8
pippatch availablevia ghsa
Product: paramikoFixed in: 2.2.3
pippatch availablevia ghsa
Product: paramikoFixed in: 2.1.5
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: ansible-0:2.4.4.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: ansible-tower-0:3.2.4-1.el7at
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-0:5.9.2.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-amazon-smartstate-0:5.9.2.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-appliance-0:5.9.2.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-gemset-0:5.9.2.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: dbus-api-service-0:1.0.1-3.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: httpd-configmap-generator-0:0.2.1-2.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: postgresql96-0:9.6.6-1PGDG.el7
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: rh-ruby23-rubygem-json-0:2.1.0-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: rh-ruby23-rubygem-qpid_proton-0:0.22.0-2.el7cf
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.4 for RHEL 7Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 7Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: python-paramiko-0:1.7.5-4.el6_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.4 Advanced Update SupportFixed in: python-paramiko-0:1.7.5-4.el6_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.5 Advanced Update SupportFixed in: python-paramiko-0:1.7.5-4.el6_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.6 Telco Extended Update SupportFixed in: python-paramiko-0:1.7.5-4.el6_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.7 Extended Update SupportFixed in: python-paramiko-0:1.7.5-4.el6_7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 ExtrasFixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: rhvm-appliance-0:4.2-20180504.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization Engine 4.1Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.6 Advanced Update SupportFixed in: python-paramiko-0:1.7.5-4.el6_6
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: ansible-0:2.4.4.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: ansible-tower-0:3.1.7-1.el7at
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: cfme-0:5.8.4.5-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: cfme-appliance-0:5.8.4.5-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: cfme-gemset-0:5.8.4.5-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: python-paramiko-0:2.1.1-4.el7
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.8Fixed in: rh-ruby23-rubygem-json-0:2.1.0-1.el7cf
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Storage 3Fixed in: python-paramiko
redhatno patchvia redhat_api
Product: Red Hat OpenShift Enterprise 3Fixed in: python-paramiko
redhatno patchvia redhat_api
Product: Red Hat Ceph Storage 2Fixed in: python-paramiko
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 13 (Queens)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 11 (Ocata)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 12 (Pike)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat Update Infrastructure 3 for Cloud ProvidersFixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 8 (Liberty)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 9 (Mitaka)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat Quickstart Cloud Installer 1Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat Storage Console 2Fixed in: python-paramiko
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 10 (Newton)Fixed in: python-paramiko

Vendor Advisories (2)

pipGHSA-232r-66cg-79pxcritical

Paramiko not properly checking authentication before processing other requests

Jul 12, 2018
redhatCVE-2018-7750Critical

python-paramiko: Authentication bypass in transport.py

Mar 13, 2018

References

access.redhat.com / errata/RHSA-2018:0591
Third Party Advisory
access.redhat.com / errata/RHSA-2018:0646
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1124
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1125
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1213
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1274
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1328
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1525
Third Party Advisory
access.redhat.com / errata/RHSA-2018:1972
Third Party Advisory
github.com / paramiko/paramiko/blob/master/sites/www/changelog.rst
Third Party Advisory
github.com / paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516
PatchThird Party Advisory
github.com / paramiko/paramiko/issues/1175
Issue TrackingThird Party Advisory
lists.debian.org / debian-lts-announce/2018/10/msg00018.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2021/12/msg00025.html
Mailing ListThird Party Advisory
usn.ubuntu.com / 3603-1
Third Party Advisory
usn.ubuntu.com / 3603-2
Third Party Advisory
exploit-db.com / exploits/45712
ExploitThird Party AdvisoryVDB Entry
securityfocus.com / bid/103713
Third Party AdvisoryVDB Entry