OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
OpenSSH flaw (CVE-2026-123158) exploited in the wild hours after disclosure.
Run Previdian?
Get an email when a reviewed story names Previdian, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability in OpenSSH, nicknamed 'sshole', is being actively exploited in the wild. The flaw allows remote attackers to log into passwordless accounts on musl-based systems like Alpine Linux by sending an oversized password. The vulnerability was fixed in OpenSSH 10.6p2 on November 5, but exploitation was observed less than nine hours after its CVE publication.
The lesson from this incident
Full lessonA critical OpenSSH vulnerability dubbed 'sshole' was actively exploited in the wild less than nine hours after its CVE was published, demonstrating how rapidly threat actors operationalize newly disclosed flaws. The flaw allows unauthenticated remote attackers to log into passwordless accounts on musl-based systems such as Alpine Linux simply by sending an oversized password, representing a severe authentication bypass. Although a patch was available in OpenSSH 10.6p2 from November 5th, the gap between patch availability and widespread deployment left countless systems exposed. This incident underscores why emergency patching procedures and rapid vulnerability response capabilities are no longer optional for organizations running internet-facing SSH services.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-123158
- ip — 89.116.89.18