The facts
GreyNoise says the first successful exploitation it observed occurred on 7 November against a vulnerable GreyNoise gridpoint; the attacker gained root, but the command-and-control server was unreachable and the agent never received a task. [1]
Previdian’s sensors recorded 20 attempts from 13 unique IP addresses across nine countries between 6 and 8 November. The company says attempts do not show the target was vulnerable or that an attempt succeeded. [5]
The Hacker News reported on 6 November that Previdian had also confirmed root access on an Alpine/OpenSSH honeypot; this and GreyNoise telemetry concern honeypots, not confirmed production victims. [1][7]
The vulnerability affects some OpenSSH installations on Linux using musl libc without PAM; Red Hat says its glibc/PAM-based products are not affected. [2][3][4]
OpenSSH released version 10.6p2 on 5 November with a workaround. Alpine’s advisory tells affected users to install the fixed package and restart sshd or disable password authentication. [2][3]
CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog on 9 November. The feed sets a 12 November due date, refers users to BOD 26-04 mitigation guidance and lists known ransomware campaign use as unknown. [8]
Still unconfirmed
- The number of affected public-facing servers and any successful compromises outside research honeypots are unknown.
Corrections & updates
Update (10 November): Added CISA’s 9 November Known Exploited Vulnerabilities listing, 12 November due date and BOD 26-04 mitigation guidance. CISA’s feed lists known ransomware campaign use as unknown; the catalog entry does not establish production compromises.
Sources
References support the numbered facts above. Source checks: 10 Nov 2026, 05:18 UTC.
OpenSSH, Alpine and Red Hat describe the issue and affected configuration; OpenSSH 10.6p2 was released on 5 November. GreyNoise and Previdian first-party sensors record exploitation attempts, and independent SecurityWeek reporting corroborates honeypot exploitation. CISA’s official catalog feed added the CVE on 9 November, gives a 12 November due date and leaves known ransomware campaign use unknown. Neither sensor counts nor catalog inclusion quantify production systems compromised.
- SSHole (CVE-2026-123158) Activity 2026
GreyNoise · Primary source · 9 Nov 2026
Opened live telemetry updated 9 November. GreyNoise reports a successful exploit of its vulnerable gridpoint on 7 November, root access, and a failed attempt to enroll a command-and-control agent; the agent received no task.
- Portable OpenSSH 10.6p2 release notes
OpenSSH · Primary source · 5 Nov 2026
Opened official release notes. OpenSSH 10.6p2 was released on 5 November with a workaround for a password-authentication bypass on some Linux systems built and run with PAM disabled.
- Security advisory: openssh-server password authentication bypass
Alpine Linux · Primary source · 5 Nov 2026
Opened Alpine’s advisory. It defines the affected package/configuration conditions, identifies fixed package releases, and advises updating and restarting sshd or disabling password login.
- CVE-2026-123158
Red Hat · Primary source · 5 Nov 2026
Opened vendor CVE record; it describes the musl/no-PAM Linux scope and says Red Hat products are not affected because they use glibc and PAM.
- CVE-2026-123158 Exploitation Attempts Observed — OpenSSH
Previdian · Primary source · 9 Nov 2026
Opened first-party sensor report updated 9 November: 20 attempts, 13 unique source IPs and nine countries through 8 November. The vendor explicitly says sensor attempts do not establish that targets were vulnerable or that a login succeeded.
- Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
SecurityWeek · Reporting · 9 Nov 2026
Opened independent security report. It describes the limited configuration, patch status and sensor reports of attempted exploitation.
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
The Hacker News · Reporting · 6 Nov 2026
Opened independent 6 November report that quotes Previdian as confirming successful root access on an Alpine honeypot and records attempts against its telemetry.
- Known Exploited Vulnerabilities Catalog JSON feed
Cybersecurity and Infrastructure Security Agency (CISA) · Primary source · 9 Nov 2026
Opened the official catalog feed directly. Its 9 November release lists CVE-2026-123158 as added that date, gives a 12 November due date, refers to BOD 26-04 mitigation guidance, and marks known ransomware campaign use as Unknown.