Event Monitor Cyber
EM-20261105-CR0Y VulnerabilityHigh severity

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CVE-2026-123158 · OpenBSD OpenSSH

Share

21 hours from first report to confirmed exploitation.

Status
Confirmed

Since : exploitation in the wild reported.

First Signal
Nov 05 15:46 UTCC41 Red Hat Security Data
Page Born
Nov 05 16:17 UTCsecond source joined
Last Signal
Nov 09 16:04 UTC9 hours before snapshot
Sources
83 official · 5 research, news or crowd
Open For
4 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Nov 05 16:17 UTC
    C6 NVD published
  2. Scored: reached
    Nov 05 16:17 UTC
    CVSS 8.1 · EPSS 1.0%
  3. Exploited: reached
    Nov 06 12:49 UTC
    C1 CISA KEV, fix by Nov 12
  4. Advisories: reached
    Nov 09 12:00 UTC
    1 government and CERT sources
  5. Vendor Response: reached
    Nov 05 15:46 UTC
    C41 published
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline Nov 12, then 14 quiet days

Timeline

12:00Nov 612:00Nov 712:00Nov 812:00Nov 912:00BornConfirmedC41 Red Hat Security DataC6 NVD CVE API 2.0C134 Help Net SecurityC130 The Hacker NewsC91 SANS ISC / DShield InfoConC1 CISA Known Exploited VulnerabilitC2 CISA Cybersecurity AdvisoriesC126 BleepingComputer

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. Hackers exploit SSHole OpenSSH flaw to breach Linux systems (opens source in a new tab) Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...] Med severityResearch & NewsC126 BleepingComputer
  2. CISA Adds Four Known Exploited Vulnerabilities to Catalog (opens source in a new tab) CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779… High severityGovernmentC2 CISA Cybersecurity Advisories
  3. CVE-2026-123158 added to KEV: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability (opens source in a new tab) OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  4. Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th) (opens source in a new tab) Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this… Info severityResearch & NewsC91 SANS ISC / DShield InfoCon
  5. Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot (opens source in a new tab) Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as… Med severityResearch & NewsC130 The Hacker News
  6. OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) (opens source in a new tab) An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158)… Med severityResearch & NewsC134 Help Net Security
  7. CVE-2026-123158 (CVSS 8.1) (opens source in a new tab) sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash)… High severityDatabaseC6 NVD CVE API 2.0
  8. Red Hat: CVE-2026-123158 (important) (opens source in a new tab) openssh: OpenSSH: Password authentication bypass via password hash misinterpretation High severityVendorC41 Red Hat Security Data