What Happened
An OpenSSH vulnerability tracked as CVE-2026-123158 and nicknamed SSHole is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 9, 2026, based on evidence of active exploitation. It went in alongside three other flaws: CVE-2026-102895 in GPUStack, CVE-2026-116779 in SignalWire FreeSwitch and CVE-2026-123218 in IBM Aspera Faspex.
BleepingComputer reports that hackers are exploiting SSHole to execute commands, steal credentials and establish persistent access. CISA describes it as an unexpected status code or return value vulnerability in OpenBSD OpenSSH on Linux that could allow authentication bypass.
Authentication bypass on a Linux host is not a small thing. The attacker does not need a working password or key to get in. Once inside, credentials get lifted and persistence gets planted, so the host can keep letting them back in after a reboot. For an MSP, the cost lands in two places: the hours spent rebuilding a client's server, and the conversation about what else that server could reach.
Timeline
CISA published the catalog entry and its alert on the same day, and press coverage followed within hours.
- November 9, 2026: CISA publishes the KEV catalog entry for CVE-2026-123158, described as an OpenBSD OpenSSH unexpected status code or return value vulnerability that could allow for authentication bypass.
- November 9, 2026: CISA publishes an alert confirming it added four vulnerabilities to the KEV catalog based on evidence of active exploitation.
- November 9, 2026: BleepingComputer reports that hackers are actively exploiting the SSHole vulnerability to execute commands, steal credentials and establish persistent access.
Who Is Affected
The affected products listed are OpenSSH, OpenSSH prior to 10.6p2, and OpenBSD OpenSSH on Linux. If a client runs OpenSSH below 10.6p2, that host is in scope until you prove otherwise.
In practice that covers more than a handful of Linux servers. SSH sits inside appliances, hypervisors, backup targets, network gear, container images and cloud instances. It is also the tool your technicians use every day, which is exactly why it gets skipped during patch cycles.
CISA's binding requirements apply to federal civilian executive branch agencies. CISA encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV catalog entries.
Any MSP with Linux in its stack should treat this as in scope until an inventory says it is not.
Why The OpenSSH Vulnerability Matters To MSPs
Most MSPs can name every Windows server they manage. Fewer can list every place OpenSSH is running. That gap is where this lands.
The systems an attacker wants are often the ones with no agent, no dashboard and no patch policy of their own. An authentication bypass there is a direct path from the network to the operating system.
The cost lands in three places: technician hours to rebuild, client downtime while it happens, and the follow-on work of rotating every credential the host could reach. Credential theft makes that third item the expensive one, because a stolen key or password can open systems that were never affected by this flaw.
As a standing practice for any SSH exposure: know where it runs, know which version, and know how fast you can rebuild if it is breached.
Technical Details
CVE: CVE-2026-123158. Product: OpenBSD OpenSSH on Linux. Affected versions: OpenSSH prior to 10.6p2. Attack vector: an unexpected status code or return value issue that could allow for authentication bypass, as CISA describes it.
CISA lists the required action as applying mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 guidance, or discontinuing use of the product if mitigations are unavailable.
Exploitation is confirmed as active by the KEV listing. BleepingComputer reports the observed outcomes as command execution, credential theft and persistent access.
The technical detail matters less than the exposure. An authentication bypass on a service that grants a shell is a short path from the internet to the operating system.
What MSPs Should Do
Patch status is only half of this. The other half is deciding whether an affected host was already reached.
- Inventory OpenSSH across every client, including appliances, hypervisors, cloud instances and anything you do not manage as a server.
- Compare versions against the affected range and flag anything prior to 10.6p2.
- Apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable, as CISA states.
- Apply any necessary updates as they become available.
- Prioritise internet-facing SSH. That is where an authentication bypass is reachable.
- For hosts that were exposed while affected, work on the assumption of compromise as a standing practice: rotate passwords, keys and service accounts, review authorized_keys, check for new accounts, keys and scheduled jobs, and rebuild from a known good image rather than cleaning in place.
- Confirm your backups are clean and restorable before you need them, and test that a restore can actually bring a client back.
- Record what you found. Clients will ask what was exposed and for how long.
How EnterProtect Helps
Two things decide how bad a day like this gets: whether the attacker can get back in after you evict them, and whether you can bring the client back up without rebuilding from nothing.
EnterProtect backup keeps clean, restorable copies of the systems and data your clients depend on. When a host has to be rebuilt, that is the difference between restoring and starting over. EnterProtect recovery is built to get a client running again, with priority on the systems that carry the business.
EnterProtect vulnerability scanning gives you a standing view of exposed versions and missing patches across an estate, so gaps show up on a list instead of in an incident.
None of that replaces patching. It is what makes patching, cleanup and a rebuild survivable when something gets through.
Frequently Asked Questions
What Is CVE-2026-123158?
CVE-2026-123158 is an OpenSSH flaw that CISA describes as an unexpected status code or return value vulnerability in OpenBSD OpenSSH on Linux that could allow for authentication bypass. It is tracked under the nickname SSHole. CISA added it to its Known Exploited Vulnerabilities catalog on November 9, 2026, based on evidence of active exploitation.
Which OpenSSH Versions Are Affected?
The affected versions listed are OpenSSH prior to 10.6p2, specifically OpenBSD OpenSSH on Linux. OpenSSH itself is also listed as an affected product. Check vendor guidance for your platform and build before you decide a host is out of scope.
Is the SSHole Flaw Being Exploited in the Wild?
Yes. CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, and the required action is to apply mitigations in accordance with vendor instructions or discontinue use of the product if mitigations are unavailable. BleepingComputer reports that hackers are exploiting the flaw to execute commands, steal credentials and establish persistent access.
What Should I Do If a Client Runs an Affected Version?
Apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable, and apply any necessary updates as they become available. If an affected host was reachable from the internet, treat it as compromised as a standing practice: rotate credentials and keys, review authorized_keys, check for new accounts and scheduled jobs, and rebuild from a known good image. Confirm your backups are clean and restorable before you rely on them.
What Does Authentication Bypass Mean for a Linux Host?
It means an attacker can get past the login step without valid credentials. On a host that grants a shell, that access is enough to run commands, read files and install persistence. Persistence is why a rebuild is usually safer than cleaning a host in place.
Does Patching Close the Incident?
Patching stops new exploitation of an affected version, but it does not remove an attacker who got in before the patch was applied. CISA's BOD 26-04 establishes expectations for when agencies must check whether threat actors compromised a system before the patch was applied. If a host was exposed, plan for credential rotation, a review of persistence locations and a rebuild from known good media.
Sources
- OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability (Cisa Kev)
- CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA alerts)
- Hackers exploit SSHole OpenSSH flaw to breach Linux systems (Bleepingcomputer)