Hackers Exploit Critical SSHole Vulnerability in OpenSSH to Gain Access to Linux Systems

Cybersecurity researchers have confirmed active exploitation of a critical authentication-bypass vulnerability in OpenSSH, raising concerns for organisations operating Linux servers in cloud environments and enterprise networks. The flaw, identified as CVE-2026-123158 and informally called SSHole, can allow attackers to bypass password authentication under specific system configurations.

Reports published on November 9 said exploitation attempts began shortly after proof-of-concept code became available on November 5. Security researchers have also documented successful intrusions, including activity in which attackers obtained elevated privileges and attempted to establish persistent access.

How the Vulnerability Works

The vulnerability affects OpenSSH running on certain Linux systems using the musl C library, including environments based on Alpine Linux. Under particular authentication conditions, an unusually long password can trigger an error in the password-hashing process.

The affected implementation may incorrectly treat the resulting value as a match for accounts configured with a disabled-password marker. This can allow an attacker to authenticate without knowing the account’s actual password.

The flaw does not affect every OpenSSH installation. Exploitation depends on the operating system’s configuration, authentication settings and the presence of affected account records. However, systems meeting those conditions may face serious consequences, particularly where compromised accounts have administrative privileges.

Researchers Observe Successful Intrusions

Threat intelligence firm GreyNoise reported successful exploitation attempts in monitored environments. Investigators recorded activity involving system and container reconnaissance, attempts to access cloud metadata services, searches for password hashes and SSH keys, and efforts to modify authorised SSH keys.

One observed intrusion involved an attacker obtaining root privileges and attempting to install a Python-based command-and-control agent. Other security companies also reported exploitation attempts linked to botnet and cryptocurrency-mining activity.

The available telemetry represents activity seen by individual security researchers and monitoring networks. It should not be interpreted as a complete count of all affected systems or attacks worldwide.

Organisations Urged to Patch Exposed Systems

OpenSSH maintainers released version 10.6p2 on November 5 to address the vulnerability. Security teams are being advised to install the appropriate update and review authentication settings on potentially affected Linux systems.

Where immediate patching is not possible, administrators should assess whether password-based SSH authentication can be disabled and examine logs for unusual successful logins. They should also check for unexpected changes to authorised SSH keys and suspicious startup services.

The incident highlights how a vulnerability affecting a specific combination of software and operating-system components can create risks across cloud infrastructure. Organisations with large numbers of Linux servers will need to identify affected configurations quickly and confirm that remediation has been applied consistently.