The vulnerability CVE-2026-123158, known as SSHole, has been identified in Linux systems running OpenSSH with the musl C library and Pluggable Authentication Modules (PAM) disabled. It has a CVSS score of 8.1, indicating high severity.
SSHole allows unauthenticated attackers to exploit systems by supplying an oversized password to access accounts without usable passwords. Successful exploitation can lead to unauthorized access to deployment credentials, application secrets, and connected infrastructure.
The first exploitation attempt was observed less than nine hours after the CVE was published on November 5, 2026. By November 8, 2026, there were 20 exploitation attempts from 13 unique IP addresses across multiple countries, including Japan, Denmark, Iran, and the U.S.
OpenSSH maintainers released a fix in version 10.6p2 on November 5, 2026. Despite this, the first successful exploitation in the wild was recorded on November 7, 2026. Attackers have been observed running reconnaissance commands and attempting to modify SSH 'authorized_keys' files.
In one incident, an attacker gained root privileges and installed a Python command-and-control agent called TAC Agent, although it failed to connect to its command-and-control server. Telemetry data from Previdian confirmed successful exploitation of SSHole.
System administrators are advised to update OpenSSH or disable SSH password authentication on affected systems to mitigate the risk of exploitation.