SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
11 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-123158 · CVSS 8.1

OpenBSD OpenSSH: attackers can get in without a password

AFFECTSOpenBSD OpenSSH

OFFICIAL NAME: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 5 days old, so many systems are likely still unpatched.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The confirmation is 2 days old.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 6 INDEPENDENT SOURCES

    CVE-2026-123158 discussed publicly (CIRCL sighting). CVE-2026-123158 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-123158 reported (CIRCL sighting). CISA Vulnrichment marks CVE-2026-123158 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-123158 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CVE List V5 and CISA Vulnrichment
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 4 days after disclosure. CISA listed it 4 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. CISA set Nov 12, 2026 as the deadline for US federal agencies. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. NOV 5, 2026
    27 public GitHub repositories claim a proof of concept for CVE-2026-123158
  2. NOV 6, 2026
    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
  3. NOV 6, 2026
    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
  4. NOV 8, 2026
    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)
  5. Attack activity. NOV 8, 2026
    OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
  6. NOV 9, 2026
    CVE-2026-123158 discussed publicly (CIRCL sighting) (55 reports, latest NOV 10)
  7. NOV 9, 2026
    Hackers exploit SSHole OpenSSH flaw to breach Linux systems
  8. Attack activity. NOV 9, 2026
    CISA Vulnrichment marks CVE-2026-123158 as actively exploited
  9. NOV 9, 2026
    OpenBSD security advisory (AV26-1130) - Update 1
  10. Attack activity. NOV 9, 2026
    Exploitation of CVE-2026-123158 reported (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-123158 discussed publicly (CIRCL sighting), NOV 10
  2. [2] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-123158 reported (CIRCL sighting), NOV 9
  3. [3] Canadian Centre for Cyber Security: OpenBSD security advisory (AV26-1130) - Update 1, NOV 9
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-123158 as actively exploited, NOV 9
  5. [5] BleepingComputer: Hackers exploit SSHole OpenSSH flaw to breach Linux systems, NOV 9
  6. [6] CISA Known Exploited Vulnerabilities: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability, NOV 8
  7. [7] SANS Internet Storm Center: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th), NOV 8
  8. [8] The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot, NOV 6
  9. [9] Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158), NOV 6
  10. [10] PoC-in-GitHub: 27 public GitHub repositories claim a proof of concept for CVE-2026-123158, NOV 5
  11. [11] CIRCL Vulnerability-Lookup sightings: 54 more reports