Is SMG affect by CVE-2026-55200

Products

• Messaging Gateway

Issue/Introduction

The vulnerable function is ssh2_transport_read() — this is the code path that reads and parses SSH packets received from a server. It is in the SSH client receive loop. The bug is that the client blindly trusts the packet_length field sent by the server without checking it against its internal buffer size. The overflow happens on the client, triggered by what the server sends.

This means the victim must be the SSH client, and the attacker must be the SSH server (or a man-in-the-middle injecting server-side packets). An attacker sitting on the internet cannot simply connect to SMG's port 22 and exploit this — that would require OpenSSH to be vulnerable, which it is not.

https://cyberq.tw/2026/06/23/cve-2026-55200-libssh2/

 

Resolution

Symantec Messaging Gateway (SMG) is not practically vulnerable for the following reasons:

- SMG's SCP transfers use the OpenSSH binary (/usr/bin/scp), not libssh2.
- libssh2 is only present on the appliance as a transitive dependency of curl and is completely dormant; no SMG code paths exercise it for SSH operations.

Because OpenSSH is unaffected and libssh2 is unused, this issue poses zero operational risk to SMG customers.