Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list

Part of the CVE-2026-123158 story · since 5 Nov

Developinglatest 7 hours ago11 articles9 outlets
5 Nov · cybersixt first8 Nov9 NovNowThis article9th of 11
  • Thu 5 Nov, 16:50 UTC. cybersixt, first report. OpenSSH flaw exploited to log into key-only Alpine accounts. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. SOCRadar, its first report on the story. OpenSSH fixes password bypass affecting Alpine Linux systems. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 13:00 UTC. SecurityWeek, its first report on the story. OpenSSH patches SSHole flaw that bypasses password authentication. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 17:30 UTC. The Hacker News, its first report on the story. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 23:00 UTC. StepSecurity, its first report on the story. OpenSSH flaw lets attackers bypass password checks on Alpine Linux. Cites a CVE in CISA KEV.
  • Sun 8 Nov, 17:00 UTC. SANS ISC, its first report on the story. SANS honeypots record rising attempts to exploit Sshole. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 13:00 UTC. SecurityWeek. Attackers Exploit OpenSSH Authentication Bypass in the Wild. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 15:00 UTC. The Hacker News. OpenSSH flaw allows passwordless logins on musl systems. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV. This article, 9th of 11.
  • Mon 9 Nov, 20:30 UTC. Ars Technica, its first report on the story. Hackers exploit OpenSSH flaw to access Linux accounts without passwords. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.

CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026. The entry affects OpenBSD OpenSSH on Linux and describes an unexpected status code or return value vulnerability that could allow authentication bypass.

The flaw is classified as an unexpected status code or return value vulnerability. The available description says it could enable an attacker to bypass authentication, but does not specify further details about the attack vector or impact. It has a CVSS score of 8.1, rated High. Patch status is unknown, and no patch or advisory URL was provided in the supplied data.

KEV inclusion indicates that active exploitation has been confirmed. Use in ransomware campaigns is unknown. CISA set a remediation deadline of 12 November 2026, leaving a short window for affected organisations to assess and address exposure.

CISA requires organisations to apply mitigations in accordance with vendor instructions and follow applicable BOD 26-04 guidance on prioritising security updates based on risk, alongside its forensics triage requirements. For cloud services, organisations should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s requirements. All organisations should evaluate affected assets, including their internet exposure, and review their patching and mitigation plans.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-123158) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).

How the story developed

All 11 articles
Developinglatest 7 hours ago11 articles9 outlets

11 articles from 9 outlets since 5 Nov. Still developing; the latest report was 7 hours ago. This was the 9th report, 4 days after the first.

Now5 Nov789First reportcybersixt · 5 Nov, 16:50This article9th of 11 · day 4
  • Thu 5 Nov, 16:50 UTC. cybersixt, first report. OpenSSH flaw exploited to log into key-only Alpine accounts. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. SOCRadar, its first report on the story. OpenSSH fixes password bypass affecting Alpine Linux systems. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 13:00 UTC. SecurityWeek, its first report on the story. OpenSSH patches SSHole flaw that bypasses password authentication. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 17:30 UTC. The Hacker News, its first report on the story. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 23:00 UTC. StepSecurity, its first report on the story. OpenSSH flaw lets attackers bypass password checks on Alpine Linux. Cites a CVE in CISA KEV.
  • Sun 8 Nov, 17:00 UTC. SANS ISC, its first report on the story. SANS honeypots record rising attempts to exploit Sshole. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 13:00 UTC. SecurityWeek. Attackers Exploit OpenSSH Authentication Bypass in the Wild. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 15:00 UTC. The Hacker News. OpenSSH flaw allows passwordless logins on musl systems. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV. This article, 9th of 11.
  • Mon 9 Nov, 20:30 UTC. Ars Technica, its first report on the story. Hackers exploit OpenSSH flaw to access Linux accounts without passwords. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 11 articles as a list
  1. Thu 5 NovDay 01
    1. OpenSSH flaw exploited to log into key-only Alpine accounts16:50 · cybersixt · First report · Exploited CVE · Known exploited CVE
  2. Fri 6 NovDay 14
    1. OpenSSH fixes password bypass affecting Alpine Linux systems11:00 · SOCRadar · Known exploited CVE
    2. OpenSSH patches SSHole flaw that bypasses password authentication13:00 · SecurityWeek · Known exploited CVE
    3. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access17:30 · The Hacker News · Known exploited CVE
    4. OpenSSH flaw lets attackers bypass password checks on Alpine Linux23:00 · StepSecurity · Known exploited CVE

  3. Quiet for 2 days

    Sun 8 NovDay 31
    1. SANS honeypots record rising attempts to exploit Sshole17:00 · SANS ISC · Known exploited CVE
  4. Mon 9 NovDay 44
    1. Attackers Exploit OpenSSH Authentication Bypass in the Wild13:00 · SecurityWeek · Known exploited CVE
    2. OpenSSH flaw allows passwordless logins on musl systems15:00 · The Hacker News · Known exploited CVE
    3. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list17:01 · CISA · official · CISA alert · Known exploited CVE · This article, 9th of 11
    4. Hackers exploit OpenSSH flaw to access Linux accounts without passwords20:30 · Ars Technica · Known exploited CVE
  5. Tue 10 NovDay 51
    1. CISA adds four flaws exploited in the wild to its KEV catalog01:31 · SecurityOnline · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in