Yes. Previdian sensors have observed 8 exploitation attempts, 1 unique attacker IP, and 1 country targeting CVE-2026-123158. First observed Nov 06, 2026. Confidence is confirmed.
OpenBSD / OpenSSH affected before 10.6p2.
Patch immediately, validate internet-facing exposure, and monitor for matching requests.
OpenSSH Authentication Bypass
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds.
An example of a platform using musl libc without PAM is Alpine Linux.
CVE Record CVE.org · CVE Record
openssh.org/releasenotes.html openssh.org · CVE Record
GitHub — openssh/openssh-portable github.com · CVE Record
news.ycombinator.com/item news.ycombinator.com · CVE Record
news.ycombinator.com/item news.ycombinator.com · CVE Record
marc.info marc.info · CVE Record
hachyderm.io/@damienmiller/117563026759098135 hachyderm.io · CVE Record
GitHub — predkambrij/sshhole-repro github.com · CVE Record
GitHub — leonjza/sshhole-lab github.com · CVE Record
Exploitation Attempts Observed in the Wild
Previdian sensors observed exploitation attempts targeting this vulnerability.
Exploitation Attempts Observed
Previdian sensors observed exploitation attempts targeting this vulnerability.
Proof of concept available
Public scanner or PoC coverage increases practical exploitability.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Operational indicators for this CVE are listed under Detection .
CVE-2026-123158 exploitation attempts over the last 7 days
Daily events observed by Previdian sensors
First observed 06 Nov 2026 · Last observed 06 Nov 2026
Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.
No scanner integrations recorded yet.
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Attacker IP Indicators
Attacker IP indicators observed · available in Pro and Enterprise.
Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.
Potential damage if exploited. Separate from whether attackers are using it.
Estimated chance of exploitation in the 30 days. Previdian's warning comes from evidence, not this score.
Recent mention · SOCRadar
sshole: OpenSSH Fixes Password Bypass on Alpine Linux
OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw, tracked as CVE-2026-123158 and nicknamed “sshole,” affects Linux systems that run OpenSSH on the musl C...
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
github · Created 2026-11-06 10:53:29 UTC · 1 stars · AI assessment 86%
OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing
github · Created 2026-11-06 08:01:34 UTC · 0 stars · AI assessment 84%
Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).
1dayexploit · Created 2026-11-05 20:16:30 UTC
sshhole (CVE-2026-123158): OpenSSH pre-auth authentication bypass on musl libc. Any password 257-1024 bytes bypasses auth for disabled accounts. Remote account takeover, uid 0 possible.
cve · Created Unknown
06 Nov 2026 00:05 UTC Indicator of compromise added Indicators of compromise recorded
Indicator of compromise added
Indicators of compromise recorded
06 Nov 2026 00:05 UTC Observed by Previdian sensors Previdian sensors observed exploitation attempts targeting this vulnerability.
Observed by Previdian sensors
Previdian sensors observed exploitation attempts targeting this vulnerability.
05 Nov 2026 18:12 UTC CVE ID assigned Previously tracked as VULN-2026-0006
Previously tracked as VULN-2026-0006
05 Nov 2026 17:30 UTC Public PoC available Public proof-of-concept code published
Public proof-of-concept code published
05 Nov 2026 15:46 UTC CVE published Vulnerability disclosed publicly
Vulnerability disclosed publicly
05 Nov 2026 15:46 UTC CVE ID reserved Identifier reserved by the CNA
Identifier reserved by the CNA
05 Nov 2026 15:19 UTC Added to the Previdian watchlist Pro and Enterprise Watch users had 1 day of early warning before Previdian KEV.
Added to the Previdian watchlist
Pro and Enterprise Watch users had 1 day of early warning before Previdian KEV.
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2026-123158
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
