NewsGreyNoise
Global Event: SSHole (CVE-2026-123158) Live Activity Report
Teaser from the source
GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of CVE-2026-123158, also known as "SSHole," a flaw in OpenSSH on musl-based Linux (such as Alpine) that lets an oversized password authenticate to accounts configured to reject password logins.
This is the RSS-feed teaser. Read the full article at the original source.
Read at GreyNoiseLinked advisories
- CVE-2026-123158OpenBSD OpenSSH — OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
- CVE-2026-123158CVE-2026-123158 affecting OpenSSH on Linux
- CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpreta…
- CVE-2026-123158OpenSSH Security Restriction Bypass Vulnerability
- CVE-2026-123158Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (CVE-2026-123158)
- CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- CVE-2026-123158OpenSSH: Schwachstelle ermöglicht Erlangen von Administratorrechten
- CVE-2026-123158OpenBSD OpenSSH: Umgehung der Authentifizierung
Affected vendors and products
More on Global
Other advisories
- Highosv:MAL-2026-19256Malicious code in node-global-key-listener-v9 (npm)
- HighCVE-2026-58498BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffe…
- MediumCVE-2026-128037In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's chec…
- HighCVE-2026-126487OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by st…
- MediumCVE-2026-127209Xiaomi Mi Browser (com.mi.globalbrowser): Pfadüberschreitung (Path Traversal)
- MediumCVE-2026-127209Xiaomi Mi Browser (com.mi.globalbrowser): Pfadüberschreitung (Path Traversal)
- MediumCVE-2026-127209Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity…
- Not ratedosv:CVE-2026-52786BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
Other news entries
- Microsoft Struggles to Restore Email and Other Services in a Global OutageNewsSecurityWeek
- Palo Alto Networks GlobalProtect: Schwachstelle ermöglicht PrivilegieneskalationVulnerabilityBSI CERT-Bund
- The global socket: how threat actors are weaponizing GSocket for stealthy C2NewsMicrosoft Threat Intelligence
- New malware doesn’t call home, it turns your Exchange server into its homeNewsCSO Online
- Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product SecurityNewsCSO Online
- Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to IndiaNewsDark Reading
- US bans MEXC crypto exchange over sanctions evasion, cybercrime linksNewsBleepingComputer
- U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory LossesNewsThe Hacker News
Source: https://www.greynoise.io/blog/global-event-sshole-cve-2026-123158-live-activity-report
ID