SANS ISC sees exploit scans against sshole SSH vulnerability CVE-2026-123158

SANS ISC honeypots — decoy systems that log attack traffic — detected a rise in exploit scans for the sshole SSH flaw tracked as CVE-2026-123158 on Nov. 8, 2026, following last week’s disclosure of the flaw.

Johannes B. Ullrich of SANS said on Nov. 8, 2026, that the jump followed the prior week’s disclosure of the sshole flaw, and SANS ISC provided the scanning activity report.

The first real exploit attempt landed on Nov. 5, 2026, using a password consisting only of A characters. SANS data shows long-password use has been rising since Nov. 1, 2026, although the passwords seen that day do not seem tied to the exploit; some entries may come from buggy scripts that drop shell commands into password fields. The rise in long-password use began before the first observed exploit attempt on Nov. 5.

Previdian said on Nov. 6, 2026, that it confirmed root access on a honeypot running Alpine Linux and OpenSSH, the open-source SSH server. Its telemetry logged eight attempts tied to an address in Japan. Ryan Dewhurst, Previdian’s CEO, said the address, 89.116.89[.]18, used oversized passwords to defeat authentication and executed reconnaissance commands including id, uname and hostname over non-interactive SSH sessions, which run commands without an interactive login. Those commands reveal the current user, operating system and system name.

CVE-2026-123158 carries a CVSS score of 8.1 – CVSS is the standard severity scale – and is codenamed SSHole or sshole. Ozgun Kultekin discovered the vulnerability, and the issue grew out of a 2016 patch for the username enumeration bug CVE-2016-6210, which let attackers check whether a username existed. Username enumeration means testing whether an account name exists before authenticating it.

It hits Linux systems that run OpenSSH on the musl C library with PAM turned off, including Alpine Linux‘s default OpenSSH setup. PAM, or pluggable authentication modules, is the system’s authentication framework, and musl is a lightweight C library used in Alpine’s default setup. Systems not affected include Dropbear, glibc-based Linux distributions (glibc is another C library), non-Linux machines and PAM-enabled systems.

An attacker without credentials can enter accounts deliberately set up without usable passwords by sending an oversized password, but only when the account’s password hash is a single asterisk. Accounts that carry a valid password hash cannot be bypassed through the flaw. Safe Security said on Nov. 6, 2026, that a breach gives the compromised account its current permissions, and said attackers could take deployment credentials and application secrets, then shift sideways through the network or knock services offline. The mechanism works without credential theft.

SANS ISC operates Cowrie honeypots for SSH data. Cowrie records interactions, yet SANS keeps only the opening 255 characters of each password, so the full passwords used in the scanning attempts are not available from its data. Ullrich expects many of the login attempts against the honeypots succeeded and intends to publish more details later.

Alpine advised on Nov. 6, 2026 to check /var/log/messages, the system log file, for sshd entries showing Accepted password for alpine, root and key-only user accounts. It also says to review doas use and to inspect accounts, files and authorized keys created recently, treating any machine as compromised unless a login can be ruled out. The fix is OpenSSH 10.6p2, which addresses the issue: administrators should install it or their distribution’s patched package and restart the sshd service.