T1098.004PersistencePrivilege Escalation
SSH Authorized Keys
Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
CVEs linked to SSH Authorized Keys
2 CVEs, by priority. Each link shows its badge.- CVE-2022-40684Fortinet Multiple Products Authentication Bypass VulnerabilityFortinet · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098.004SSH Authorized KeysMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.02%79.9priority
- CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1098.004SSH Authorized KeysAI mapping from the description · primary impact7.2%Top 5.7%77.5priority