Exploitation of OpenSSH Vulnerability CVE-2026-123158 Accelerates

• •CVE-2026-123158 allows oversized passwords to bypass authentication in OpenSSH.
• •Exploitation attempts have increased significantly since November 5, 2026.
• •CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog.

A recently disclosed vulnerability in OpenSSH, tracked as CVE-2026-123158 and codenamed 'SSHole', is experiencing an uptick in exploitation attempts. This flaw allows oversized passwords to authenticate accounts configured to reject password logins, primarily affecting musl-based Linux systems like Alpine. Since its public disclosure on November 5, 2026, threat actors have begun exploiting this vulnerability, with confirmed attempts recorded from multiple IP addresses across various countries. The first successful exploitation was noted on November 7, originating from a Chinese IP address. Cybersecurity firms are actively monitoring the situation, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities Catalog. The vulnerability is considered easy to exploit, with public proof-of-concept code available. Security experts warn that the impact could be widespread due to the use of Alpine Linux in containerized environments.