{"id":"EM-20261105-CR0Y","url":"https://cyber.eventmonitor.net/incident/EM-20261105-CR0Y/openssh-vulnerability-cve-2026-123158/","type":"cve","title":"OpenSSH Vulnerability (CVE-2026-123158)","subtitle":"CVE-2026-123158","subject":"CVE-2026-123158","status":"Confirmed","severity":"high","affected":[],"headline":"21 hours from first report to confirmed exploitation.","born":"2026-11-05T16:17:47.110Z","firstSignal":"2026-11-05T15:46:26.000Z","lastSignal":"2026-11-06T12:49:41.000Z","updated":"2026-11-06T12:54:46.525Z","revision":3,"life":[{"status":"Born","at":"2026-11-05T16:17:47.110Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T16:17:47.110Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-06T12:49:41.000Z","why":"exploitation in the wild reported"}],"changeLog":[{"at":"2026-11-05T15:46:26.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T16:17:47.110Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-CR0Y created."},{"at":"2026-11-06T12:49:41.000Z","what":"Source joined: C134 Help Net Security"},{"at":"2026-11-06T12:49:41.000Z","what":"Status: Confirmed (exploitation in the wild reported)"}],"stages":[{"name":"Disclosed","at":"2026-11-05T16:17:47.110Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T16:17:47.110Z","detail":"CVSS 8.1"},{"name":"Exploited","at":"2026-11-06T12:49:41.000Z","detail":"C134 reports use in the wild"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T15:46:26.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T15:46:26.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-123158 (important)","text":"openssh: OpenSSH: Password authentication bypass via password hash misinterpretation","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-123158.json"},{"at":"2026-11-05T16:17:47.110Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-123158 (CVSS 8.1)","text":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158"},{"at":"2026-11-06T12:49:41.000Z","source":"C134","sourceName":"Help Net Security","role":"Research & News","severity":2,"title":"OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)","text":"An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5. “An attacker who can reach your SSH port can log in without knowing any password. It…","url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T16:17:47.110","score":8.1,"severity":"HIGH","desc":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024…","product":"","seen":1793950488209},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}