[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnKGoWUY77_1sunIkI1Hs33cv84Uf4ZjmbQnol2TyAp0":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ef244b25-16a9-4645-af02-e88baa99e217","OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass","openssh-rushes-patches-for-sshole-authentication-bypass-5e2fc4","On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters. The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek.","OpenSSH has released emergency patches for a critical authentication bypass vulnerability, dubbed SSHole (CVE-2026-123158), affecting its server software. The flaw allows attackers to bypass authentication on specific Linux distributions using musl libc without PAM by providing a password between 257 and 1024 characters. This could grant unauthorized access to accounts, including root, which should not accept password logins.","OpenSSH rushes patches for 'SSHole' authentication bypass vulnerability (CVE-2026-123158).","https:\u002F\u002Fwww.securityweek.com\u002Fopenssh-rushes-patches-for-sshole-authentication-bypass\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FSSH.webp","2026-11-06T12:07:42+00:00","2026-11-06T13:00:26.859677+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":19},"sshd",{"name":23,"type":24},"musl libc","technology",{"name":26,"type":24},"PAM",{"name":28,"type":19},"Alpine Linux",{"name":30,"type":19},"OpenWrt","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-123158","SSHole authentication bypass vulnerability",[18,21,28],{"controls":61,"vendors":142},[62,91,117],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,101,109],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":97,"product_name":98,"url":99,"description":100},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":118,"name":119,"problem":120,"products":121},"patch-management","Automated patch management","Known holes get closed in days, not months.",[122,127,135],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":123,"product_name":124,"url":125,"description":126},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":118,"product_name":139,"url":140,"description":141},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"openssh-authentication-bypass-highlights-critical-patching-urgency","OpenSSH Authentication Bypass Highlights Critical Patching Urgency","A critical vulnerability in OpenSSH, dubbed SSHole (CVE-2026-123158), allows attackers to bypass authentication entirely on affected Linux systems using musl libc without PAM, potentially granting root-level access. The flaw exploits an edge case in password length handling (257–1024 characters), meaning accounts that should never accept password logins can be compromised silently. This is particularly dangerous because SSH is a foundational remote access protocol trusted across virtually every enterprise environment. The emergency patch release underscores how a single unpatched server component can collapse an entire security boundary. Organizations without rapid patch deployment processes are exposed for every hour this vulnerability remains unaddressed.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":156,"PCI DSS Requirement 6":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 mandates incident handling and vulnerability management practices for essential entities; the SSHhole flaw affecting critical infrastructure SSH access requires both rapid patching and incident response readiness.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems by applying security patches promptly; any cardholder data environment running vulnerable OpenSSH would be non-compliant until patched.","SI-2 requires organizations to identify, report, and correct information system flaws—having a formal flaw remediation process with defined timelines would have ensured emergency patches were applied rapidly.","Running an unpatched version of OpenSSH directly matches this risk category, which warns that using vulnerable components can undermine application defenses and enable full system compromise.","SSHole is a critical remotely exploitable flaw; continuous vulnerability scanning would have identified unpatched OpenSSH instances immediately upon CVE disclosure and triggered remediation before exploitation.","This control requires timely identification and remediation of technical vulnerabilities; applying it would have mandated tracking CVE-2026-123158 and deploying patches within a risk-defined timeframe.","The vulnerability bypasses authentication entirely, violating the principle that only authorized identities should gain access; enforcing key-based-only authentication as a compensating control falls directly under this function."]