Linux OpenSSH Vulnerability Under Active Global Exploitation

10 November 2026 · Source balance: Centre

A critical security flaw in OpenSSH called SSHole has been actively exploited by hackers worldwide since early November 2026. The vulnerability, tracked as CVE-2026-123158 with a severity score of 8.1, affects certain Linux systems running OpenSSH on the musl library without password authentication modules, particularly Alpine Linux used in cloud environments. The flaw was publicly disclosed on November 5, with a patch released the same day, but exploitation began within nine hours. Security firms have documented successful attacks from attackers in multiple countries, with hackers stealing credentials, executing commands, and establishing persistent access. Attackers can log into password-disabled accounts using oversized passwords between 257 and 1,024 bytes. The US Cybersecurity and Infrastructure Security Agency added it to its known exploited vulnerabilities list on November 9, giving federal agencies until November 12 to patch. GreyNoise recorded 16 successful exploitation chains, while other security companies detected 20 attempts from 13 IP addresses across nine countries. The affected systems are those combining OpenSSH, musl library, and disabled password authentication modules, a configuration common in containerized and embedded Linux deployments.