[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSPMw4Ehp0pBXt-Xo97ATR7lTB2NEb8NMw1dWcekw-xE":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"99e80858-24ba-4082-a09c-cde7e0d21e9d","CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability","cisa-confirms-hackers-are-exploiting-sshole-the-openssh-vulnerability-4fec47","CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key. The OpenSSH flaw affects specific server configurations, carries a CVSS score of 8.1, and was added to CISA’s KEV catalog on November 9, 2026, with a November 12 […] The post CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability appeared first on Cyber Security News.","CISA has confirmed active exploitation of SSHole (CVE-2026-123158), an OpenSSH vulnerability that allows remote attackers to bypass authentication and access certain Linux accounts without a password or SSH key. The flaw affects specific server configurations, particularly those using musl libc and not PAM for password checks, such as Alpine Linux. The vulnerability, with a CVSS score of 8.1, was added to CISA's KEV catalog, requiring remediation by November 12, 2026, under Binding Operational Directive 26-04. Organizations are advised to assess exposed systems, install patched packages, and investigate for signs of compromise.","CISA confirms active exploitation of SSHole, an OpenSSH vulnerability allowing passwordless access.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploiting-sshole-the-openssh-bug\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FCISA-Confirms-Hackers-are-Exploiting-SSHole-the-OpenSSH-bug.webp","2026-11-10T13:53:36+00:00","2026-11-10T14:00:28.466518+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"Linux","technology",{"name":24,"type":22},"musl libc",{"name":26,"type":22},"PAM",{"name":28,"type":19},"Alpine Linux","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-123158","SSHole OpenSSH authentication bypass vulnerability",[18,28],{"controls":54,"vendors":138},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":85,"product_name":106,"url":107,"description":108},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"active-exploitation-of-openssh-auth-bypass-flaw-demands-urgent-patching","Active Exploitation of OpenSSH Auth-Bypass Flaw Demands Urgent Patching","The SSHole vulnerability (CVE-2026-123158) allows remote attackers to bypass SSH authentication entirely on systems using musl libc without PAM-based password checks, such as Alpine Linux — a configuration common in containerized and lightweight server environments. CISA's addition of this flaw to the KEV catalog confirms it is being actively exploited in the wild, meaning organizations that delay patching face immediate, real-world risk of unauthorized system access. The root issue is that a critical authentication mechanism can be circumvented due to a code-level flaw in a widely deployed remote access service, exposing systems at the network perimeter. This matters because SSH is a primary administrative channel; compromising it can give attackers privileged footholds for lateral movement, data exfiltration, or persistent backdoor installation. Organizations must treat this as an emergency patching event and simultaneously investigate for signs of prior compromise.",[144,145,146,147,148],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":150,"NIST SP 800-53 SI-2: Flaw Remediation":151,"CIS Control 2: Inventory and Control of Software Assets":152,"CIS Control 7: Continuous Vulnerability Management (v8)":153,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":154},"This provision requires entities to have processes for vulnerability handling and disclosure, meaning they must have mechanisms to detect, assess, and patch critical flaws like SSHole before or immediately upon exploitation confirmation.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — directly mandating the timely patching of a KEV-listed critical vulnerability like SSHole.","Knowing which systems run musl libc-based OSes without PAM is a prerequisite to scoping this vulnerability; CIS Control 2 demands maintaining that software inventory.","This control requires organizations to continuously assess and remediate vulnerabilities — a process that would have ensured SSHole was identified and patched before active exploitation reached their systems.","This category requires organizations to act on newly confirmed exploited vulnerabilities, which CISA's KEV listing of SSHole triggers as an obligation to remediate or formally accept risk."]