CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability

CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key.

The OpenSSH flaw affects specific server configurations, carries a CVSS score of 8.1, and was added to CISA’s KEV catalog on November 9, 2026, with a November 12 remediation deadline.

The entry requires forensic triage under Binding Operational Directive 26-04 and lists ransomware use as unknown. Organizations should assess exposed systems and follow vendor guidance.

SSHole affects OpenSSH on Linux when the server uses musl libc, a system software library, and checks passwords without PAM, the Linux authentication framework. Alpine Linux is one affected platform. OpenSSH versions before 10.6p2 need the upstream fix or a patched distribution package.

As explained in Cybersecurity News’s earlier OpenSSH analysis, several conditions must exist together. Password authentication must be enabled, the target account’s stored password field must contain *, and another local account must hold a valid SHA-crypt password hash. Simply running an Alpine container does not establish exposure.

The failure occurs when musl’s crypt() function receives an overly long password. For the affected hashing path, input exceeding 256 bytes can make the function return * as an error marker. OpenSSH may compare that marker with the target account’s stored * and accept the login. The documented trigger range is 257 to 1,024 bytes.

Active Exploitation of OpenSSH SSHole Flaw

Accounts with valid password hashes are not bypassed through this mechanism. The risk concerns accounts whose password fields contain the matching marker, even when administrators intended those accounts to use SSH keys. The official CVE record identifies the underlying problem as a password hash interpretation error.

The supplied SANS Internet Storm Center findings describe deliberate attempts using passwords filled with repeated “A” characters.

Researcher Johannes Ullrich recorded 232 long-password requests on November 5 and 713 on November 6. These totals represent suspicious requests, not confirmed breaches or separate attackers.

Cowrie honeypots record only the first 255 password characters, limiting analysis of longer inputs. Ullrich suspected some logins succeeded, but the supplied account does not confirm successful sessions. CISA’s listing provides the broader exploitation warning.

Administrators should install patched packages and restart sshd. OpenSSH 10.6p2 contains the upstream workaround, while distribution fixes may keep older version banners. Where updates must wait, setting PasswordAuthentication no blocks this path; confirm working key access before changing settings.

Investigation should cover successful password logins to accounts without usable passwords, unexpected privilege changes, and newly added authorized keys.

Earlier SSH honeypot research shows why monitoring must include non-interactive commands after login. Updating closes the flaw, but teams must also check whether attackers already used the affected account to run commands, change files, or establish continued access before the fix was applied.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability appeared first on Cyber Security News.