CVSS 8.1 CVE-2026-123158 OpenSSH Bypass

OpenBSD OpenSSH contains an authentication bypass vulnerability tracked as CVE-2026-123158. The vulnerability carries a base CVSS score of 8.1.

Is CVE-2026-123158 being exploited?

The Cybersecurity and Infrastructure Security Agency confirmed exploitation of the vulnerability by adding it to the Known Exploited Vulnerabilities catalog as the OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability. The first exploit-feed entry appeared on 2026-11-06, 3 days before the federal catalog listing. PurpleOps analysts recorded 28 exploit-feed entries. Analysis of the published artifacts, such as the SSHhole documentation on GitHub, shows they are documentation writeups without working exploit code. The vulnerability has a PurpleOps risk score of 68/100 based on ease of use, potential impact, spread potential, and required access. In the 2 days to 2026-11-09, we observed 6 news articles mentioning the vulnerability. During that same time, 1 Telegram message mentioned it in non-aggregator channels, alongside 1 Telegram repost by an aggregator channel.

Who is affected?

The vulnerability, assigned CWE-394, exists in the sshd daemon in OpenSSH versions before 10.6p2 on Linux. The vulnerability allows for authentication bypass when musl libc is used without PAM, due to a lack of a workaround for the misinterpretation of whether a string is intended to be a password hash. An example of an affected platform using musl libc without PAM is Alpine Linux. For some account configurations, any password between 256 and 1024 characters succeeds. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. This rating indicates the vulnerability is reachable over the network, requires no privileges and no user interaction, has high attack complexity, and causes total loss of confidentiality, integrity, and availability.

How do I detect it?

Since no indicators of compromise appear in the public reporting we collected, defenders must monitor web or application access logs for the affected service kept at full request detail. Additional required log sources include process creation logs, specifically Sysmon event 1 on Windows or auditd execve on Linux for the hosts running the service, and outbound network connection logs from those hosts. Security teams must hunt for the service process starting an interpreter or shell, files written into directories the service can execute, and outbound connections from the service host to addresses it has never contacted before. If a hunt lead hits, responders must capture the service logs and a memory image before restarting the service. Remediation requires rotating the credentials and tokens the service host held, and comparing the service's files against a known-good deployment before returning it to production.

The following Sigma rule detects a web server or application server process starting a shell or scripting interpreter, which represents the first observable step after remote code execution in a web application. Analysts must tune this rule to allow-list the maintenance jobs that legitimately run under the service account, by command line.

title: Web Service Process Spawning a Shell or Interpreter
id: a50869ab-edeb-46b0-96ca-df4922bdb116
status: experimental
description: Detects a web server or application server process starting a shell or scripting interpreter, the first observable step after remote code execution in a web application.
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\node.exe'
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/java'
      - '/node'
  selection_parent_php:
    ParentImage|contains: '/php-fpm'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python3'
      - '/perl'
  condition: (selection_parent or selection_parent_php) and selection_child
falsepositives:
  - Application maintenance or deployment scripts launched by the web service account
level: high

What should I patch first?

Federal agencies must apply mitigations in accordance with vendor instructions by 2026-11-12. Organizations must ensure compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and Forensics Triage Requirements. Administrators must follow applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders should review all affected OpenBSD OpenSSH installations on Linux to prevent the unexpected status code or return value vulnerability from allowing further access.

The PurpleOps blog publishes additional vulnerability data. Security teams deploy JINX and BUGSY to automate threat detection and hunt for the behavioral patterns described above. To see how these products accelerate investigations based on verified intelligence, visit PurpleOps AI Analysts.