Search — “CVE-2026-123158”

CISA added four vulnerabilities to the KEV catalog on 2026-11-09 with a 2026-11-12 due date: OpenSSH CVE-2026-123158 (authentication bypass on Linux builds, with Alpine/musl hosts named for update), GPUStack CVE-2026-102895 (unauthenticated admin access and secret disclosure), SignalWire FreeSwitch CVE-2026-116779 (code injection), and IBM Aspera Faspex CVE-2026-123218 (authenticated privilege escalation). The brief states GreyNoise observed a first confirmed successful exploitation of the OpenSSH flaw on Nov 7, but the CISA entries themselves print no exploitation details. Hunters should prioritize patch verification and review of OpenSSH authentication logs and GPUStack API activity.

Attackers began exploiting CVE-2026-123158 (SSHole) in OpenSSH on musl-based Linux with PAM disabled (Alpine default) within nine hours of disclosure, using oversized passwords (257–1,024 bytes) to log into accounts with '*' password hashes. Previdian confirmed root access on an Alpine honeypot, with the attacker running id, uname and hostname via non-interactive SSH sessions; attempts grew to 20 from 13 IPs by Nov 8. Hunt for 'Accepted password for' sshd entries on accounts that should not accept passwords, followed by recon commands, doas use, new users and authorized_keys changes.