Skip to content
ThreatCluster

CISA Warns of Active Exploitation of OpenSSH Vulnerability SSHole

First seen 10 Nov 2026, 15:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 15:48 UTC
  • •CISA has confirmed active exploitation of the OpenSSH vulnerability SSHole (CVE-2026-123158).
  • •The vulnerability allows remote attackers to access Linux accounts without valid credentials.
  • •Federal agencies are urged to apply fixes by November 12, 2026, to mitigate risks.

CISA has identified the SSHole vulnerability (CVE-2026-123158) in OpenSSH as being, allowing remote attackers to bypass authentication and access certain Linux accounts without valid credentials. This flaw affects specific server configurations and has a CVSS score of 8.1, indicating a high severity. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on November 9, 2026, and is urging federal civilian agencies to apply fixes by November 12, 2026. The vulnerability has been linked to attempts to steal credentials and establish persistent access. Additionally, other vulnerabilities in GPUStack, SignalWire FreeSWITCH, and IBM Aspera Faspex were also flagged by CISA, but the focus remains on SSHole due to its active exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-05
CVE-2026-123158 published
The OpenSSH vulnerability SSHole was publicly disclosed, allowing authentication bypass.
Cybersecuritynews
2026-11-06
First public PoC released
Proof-of-concept code for the SSHole vulnerability was made publicly available.
Cybersecuritynews
2026-11-09
CISA adds SSHole to KEV catalog
CISA officially listed the SSHole vulnerability as actively exploited in its Known Exploited Vulnerabilities catalog.
Feeds.4Sysops
2026-11-10
CISA issues urgent fix recommendation
CISA urged federal civilian agencies to apply patches for the SSHole vulnerability by November 12, 2026.
Feeds.4Sysops

More articles in this cluster (2)

Following this threat?

Track CVE-2026-123158 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

What is the SSHole vulnerability?
SSHole (CVE-2026-123158) is an authentication bypass flaw in OpenSSH that allows unauthorized remote access to certain Linux accounts.
How urgent is the fix for SSHole?
The fix is urgent as CISA has confirmed active exploitation, and agencies must patch by November 12, 2026.
What systems are affected by SSHole?
The vulnerability affects specific configurations of OpenSSH, particularly those allowing remote access without valid credentials.