CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability

Cybersecuritynews •Abinaya • November 10, 2026

CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key. The OpenSSH flaw affects specific server configurations, carries a CVSS score of 8.1, and was added to CISA’s KEV catalog on November 9, 2026, with a November 12 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Adds Four Critical Vulnerabilities to KEV Catalog Amid Active Exploitation On November 9, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies until November 12 to remediate. The vulnerabilities include CVE-2026-102895 in GPUStack, CVE-2026-116779 in FreeSWITCH, CVE-2026-123158 in OpenSSH, and CVE-2026-123218 in IBM Aspera Faspex. These flaws allow attackers to bypass authentication, gain administrative access, or execute commands on affected systems. CISA has confirmed exploitation of all four vulnerabilities, although specific details about the attackers and the number of affected organizations remain undisclosed. Administrators are advised to prioritize patching vulnerable systems and check for unauthorized access, especially for any accounts or credentials that may persist post-patching. 7 sources 73

Extracted Entities

CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Vulnerabilities (1)