CVE-2026-55200 libssh2 libpwn RCE Harness Execution and SSH Client Shell Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.