CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability
CISA confirms active exploitation of SSHole, an OpenSSH vulnerability allowing passwordless access.
CISA has confirmed active exploitation of SSHole (CVE-2026-123158), an OpenSSH vulnerability that allows remote attackers to bypass authentication and access certain Linux accounts without a password or SSH key. The flaw affects specific server configurations, particularly those using musl libc and not PAM for password checks, such as Alpine Linux. The vulnerability, with a CVSS score of 8.1, was added to CISA's KEV catalog, requiring remediation by November 12, 2026, under Binding Operational Directive 26-04. Organizations are advised to assess exposed systems, install patched packages, and investigate for signs of compromise.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenSSH?
Get an email when a new story names OpenSSH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SSHole vulnerability (CVE-2026-123158) allows remote attackers to bypass SSH authentication entirely on systems using musl libc without PAM-based password checks, such as Alpine Linux — a configuration common in containerized and lightweight server environments. CISA's addition of this flaw to the KEV catalog confirms it is being actively exploited in the wild, meaning organizations that delay patching face immediate, real-world risk of unauthorized system access. The root issue is that a critical authentication mechanism can be circumvented due to a code-level flaw in a widely deployed remote access service, exposing systems at the network perimeter. This matters because SSH is a primary administrative channel; compromising it can give attackers privileged footholds for lateral movement, data exfiltration, or persistent backdoor installation. Organizations must treat this as an emergency patching event and simultaneously investigate for signs of prior compromise.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-123158