CVE Watch: SSHole Hands Root to Long Passwords on Alpine SSH
Oct. 30 to Nov. 9: SSHole gives attackers root on Alpine-style OpenSSH, WordPress core is under attack with a catch in its update, and CISA flags SonicWall and an old Apple bug. Includes a paste-ready heads-up for each.
Window: Oct. 30 to Nov. 9, 2026. CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in these ten days, but the biggest story isn’t on that list yet: SSHole, an OpenSSH login bypass that GreyNoise saw used against its own sensors within two days of the fix. WordPress core is under attack too, and its update has a catch worth reading before you click it. Below are the entries that cleared the bar (Critical or High, or exploited regardless of score), with a ready-to-paste “Heads up” for each. KEV status reflects catalog version 2026.11.06.
| CVE | Vendor + product | CVSS | Exploited? | PoC | CISA KEV |
|---|---|---|---|---|---|
| CVE-2026-123158 | OpenSSH on musl without PAM (Alpine and others) | 8.1 High | Known | Public | No |
| CVE-2026-119977 | WordPress Core | 8.1 High (WordPress rates it Low) | Known | Public (unverified) | Yes, Nov. 3 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | 7.5 High (NVD record) / 7.1 High (SecurityWeek) | Known (CISA) | None known | Yes, Nov. 6 |
| CVE-2026-107441 | Zyxel GS1900 switches | 8.8 High | Known | Private | No |
| CVE-2024-27834 | Apple WebKit | 5.5 Medium | Known | None known | Yes, Nov. 4 |
| CVE-2026-116606 | Barracuda Email Security Gateway | 9.3 Critical (v4.0) | Suspected | Public (reported) | No |
| CVE-2026-111560 | Barracuda appliances | 8.6 High (v4.0) | Suspected | Public (reported) | No |
| CVE-2026-98432 | Linux kernel IPv4 TCP | 9.8 Critical (kernel CNA) / 8.1 High (Oracle, SUSE) | No evidence | Private; public repos unverified | No |
| CVE-2026-58868 | Google Android Framework | 9.8 Critical (NVD record) | No evidence | None known | No |
| CVE-2026-111357 | Ivanti Connect Secure | 7.0 High (NVD) / 8.8 High (reported) | Known | Public (chain, reported) | Yes, Oct. 30 |
| CVE-2026-118527 | Ivanti Connect Secure | 4.3 Medium | Known | Public (chain, reported) | Yes, Oct. 30 |
CVE-2026-123158: OpenBSD OpenSSH authentication bypass (SSHole)
SSHole lets an attacker log in over SSH with any very long password on certain accounts, including root. It’s in OpenSSH before 10.6p2 on Linux systems using musl libc without PAM, such as Alpine, OpenWrt, Buildroot and Yocto. The flaw is an authentication bypass: on the affected path, musl’s crypt() returns * for an oversized password, which matches the * in a passwordless account’s entry. An attacker only needs to reach SSH with password authentication on, know a * account name, and target a box with another account holding a real hash. The impact is unauthenticated root on servers, appliances and embedded gear, and GreyNoise has already seen one operator install a C2 agent that way.
Heads up: SSHole is CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). OpenSSH’s release notes call it a “critical security workaround” but give no score, it’s not on KEV as of the Nov. 6 catalog, and EPSS is 1.0% (63rd percentile), which undersells it. Exploit is PUBLIC: first code hit GitHub about four hours after the release, and GreyNoise calls it trivial. KNOWN campaign activity, unnamed: watchTowr says botnets and miners so far, and GreyNoise logged the first success on its own sensor Nov. 7, with one operator going root and dropping a Python agent it calls TAC Agent (C2 tac[.]vpnla[.]org). No APT or named actor. It’s remote over the internet, no auth, no user interaction, fully scriptable; no source describes it worming. Fix: OpenSSH 10.6p2 or Alpine’s backports, then restart sshd, since upgrading alone leaves the old daemon running. PasswordAuthentication no is a sufficient stopgap per Alpine. glibc distros, Dropbear and UsePAM yes aren’t affected. Check logs for Accepted password for on accounts with no password; OX says treat a hit as a compromise. Dates: found by Özgün Kültekin of Wakefield (discovery date not disclosed); OpenSSH says it learned of it Nov. 4 and released Nov. 5, with no long embargo, and no source calls it coordinated; CVE published Nov. 5. Scanning: KNOWN, per GreyNoise, Previdian (20 attempts from 13 IPs in 9 countries, Nov. 6 to 8) and Defused. Advisory: https://www.openssh.org/txt/release-10.6p2
Sources: OpenSSH, Alpine, GreyNoise, Previdian, SecurityWeek, The Hacker News, OX Security.
CVE-2026-119977: WordPress Core TOCTOU race condition leading to RCE
This bug lets an outsider run code on a WordPress server while it’s installing a full core update. It affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4, with backports to every branch down to 4.7.39. The type is a time-of-check time-of-use race that ends in remote code execution, caused by predictable, web-accessible staging paths under wp-content/upgrade. An attacker has to find that temporary folder and reach its installer files before WordPress cleans them up, a window that’s lasted only seconds in lab tests. The business impact is a taken-over site, including a malicious wp-config.php that the update itself copies into place.
Heads up: CVE-2026-119977 is CVSS 8.1 from Wordfence (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while WordPress’s own advisory rates it Low. It’s on KEV (added Nov. 3, federal due date Nov. 6, forensic triage required) and EPSS is 1.2% (67th percentile). Exploit is PUBLIC but unverified: Previdian lists a blog and a GitHub repo and warns they could contain malware. KNOWN activity, no named campaign: Wordfence saw attempts nine minutes after deploying its rule, then blocked 62,969 attacks in 24 hours by Oct. 30 and 12,632 in 24 hours around Nov. 4. Those are attempts; success isn’t established. No named actors. It’s remote, no auth, no user interaction and automatable, though attackers must poll repeatedly to hit the window. Fix: the trap here is that the update runs the old updater code one last time, so researcher Umut Bayram says to block web access to /wp-content/upgrade/ FIRST, confirm a 403, then update to 7.1.4 or your branch fix. Patching is required; the block is a safeguard, not a replacement. Hunt for PHP requests under wp-content/upgrade, new admins, and unfamiliar plugins or PHP files. Dates: reported by Bayram of Picus Security (discovery date not disclosed); patched Oct. 28, advisory Oct. 29, CVE published Oct. 31; sources don’t state how coordinated it was. Scanning: KNOWN, per Wordfence and Previdian. Advisory: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg
Sources: GitHub advisory, CISA, The Hacker News (KEV), The Hacker News (fix), The Hacker News (Oct. 30), Previdian.
CVE-2026-19868: SonicWall SonicOS SSLVPN SAML and MFA bypass
This flaw lets someone holding valid credentials for another login method skip SAML sign-in on a SonicWall VPN, and potentially SAML-enforced MFA with it. It affects Gen7 firewalls on SonicOS 7.3.3-7015 or older and Gen8 on 8.2.2-8015 or older, fixed in 7.3.4-7013 and 8.2.3-8015. The type is an authentication enforcement bug, which CISA catalogs as use of single-factor authentication. An attacker reaches it over the network at the SSLVPN service, needs those alternate credentials, and SonicWall says exposure requires SAML login to be enabled. The business impact is VPN access that the organization believed was protected by MFA.
Heads up: CVE-2026-19868 is 7.5 in the NVD record (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N); SecurityWeek reports 7.1. Vendor severity label wasn’t in the sources we could read, because SonicWall’s advisory page didn’t render for us. KEV: yes, added Nov. 6, due Nov. 20. EPSS is 0.6% (50th percentile). Exploitation: KNOWN per CISA’s listing, but SonicWall only says it investigated a report of “potential exploitation,” and neither has shared details. PoC: none known. Campaigns and actors: unknown, and it’s unclear whether this was a zero-day. Reachable remotely but you need valid credentials for an alternate method, so it’s not an anonymous walk-in; no user interaction, and it could be scripted once creds are in hand. Fix: patching is required and SonicWall says there are no workarounds; Gen6 and older are end of support with no firmware coming. After patching, review auth logs and rotate exposed credentials, because a patch won’t tell you if someone already got in. The same advisory fixes six other flaws, including two 8.8s in the management interface, none marked exploited. Dates: reported by Ryan Harris of The Electronic Office (discovery date not disclosed); advisory and CVE published Nov. 6; coordination not stated. Scanning: none reported. Advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
Sources: SecurityWeek, CISA, eSecurityPlanet, NVD.
CVE-2026-107441: Zyxel GS1900 out-of-bounds write
This is the bug that was really behind the GS1900 switch hacks first blamed on an older, patched flaw. It affects ten GS1900 models on firmware 2.90 up to the .2 builds, such as GS1900-24E through 2.90(AAHK.2)C0, and the .3 builds fix it. The type is an out-of-bounds write in the CGI program that can give OS command execution. Zyxel says an unauthenticated attacker on the LAN can trigger it with a crafted HTTP request. The business impact is a hijacked switch, with attackers stealing configuration files and hashed root credentials from nearly 1,000 devices.
Heads up: CVE-2026-107441 is CVSS 8.8 from Zyxel (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No separate vendor label. It’s not among KEV’s additions as of the Nov. 6 catalog, though the earlier CVE-2026-7273 went on Sept. 21. EPSS is 0.29% (22nd percentile). Exploitation is KNOWN: Binarly found the campaign’s exploit in an exposed archive and showed it still worked on firmware patched for CVE-2026-7273. That exploit looks PRIVATELY held; no public PoC reported. Campaign: GreyNoise counted 996 devices across 48 countries starting around Aug. 17. Actor: SUSPECTED Chinese-speaking Kapibala, which GreyNoise believes is the same as or close to Red Heron, with JITTERLY and SIXZUT malware reported. Access: Zyxel scores this as adjacent/LAN, and no source says how the campaign reached these devices, so don’t assume the internet is the only path. No auth, no user interaction, automated at scale. Fix: firmware is required and no workaround is published. Keep management off untrusted networks as general hygiene, and change credentials since hashes were taken (564 victims were on factory defaults, per SecurityWeek). Dates: reported by Binarly’s Yegor Vasilenko and Fernando Mercês on Sept. 29; confirmed Oct. 11; firmware Oct. 22 or 23 (sources differ); advisory and CVE Nov. 3. Vendor-researcher handling looks coordinated, but no source says so outright. Scanning: not separately reported. Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
Sources: Zyxel, BleepingComputer, SecurityWeek, SecurityWeek (Sept.), Binarly.
CVE-2024-27834: Apple WebKit Pointer Authentication bypass
Why now: fixed in May 2024, but Sekoia’s Nov. 4 report ties it to an APT29 watering-hole campaign and CISA added it to KEV the same day.
This is a bypass of Pointer Authentication, the Apple hardware defense that makes memory-corruption exploits harder. Apple fixed it in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. The type is improper authentication (CWE-287), and it scores low because it needs arbitrary read and write capability first. Attackers reach it by pairing it with a WebKit code-execution bug, here CVE-2025-43529, on a compromised website the victim visits. The business impact falls on old, unpatched iPhones, where Sekoia says this chain steals iOS cookies.
Heads up: CVE-2024-27834 is CVSS 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); it’s here only because it’s exploited. No vendor label beyond that. KEV: yes, added Nov. 4, due Nov. 18. EPSS is 1.5% (74th percentile). Exploit: no public PoC reported; Sekoia describes the chain being served live to visitors. Campaign: KNOWN watering holes per Sekoia, including a compromised Plerdy analytics tracker and fake sites, with separate chains for iOS 18.5 and Android Chrome. Actor: Sekoia assesses APT29 with “moderate to high confidence” (still an attribution hypothesis, so treat as SUSPECTED), and CISA names no one. Access: remote via a web visit, user has to browse to a poisoned page, no login, automated delivery, not wormable by any account. Fix: patching only, and Sekoia says up-to-date devices are safe from these chains. So find anything stuck on old iOS and retire or update it. Unanswered: Sekoia says the host filters for iOS 16.7 and 16.7.10, which is above Apple’s 16.7.8 fix, and no source reconciles that. Dates: demonstrated at Pwn2Own Vancouver, March 2024, per The Hacker News, by Manfred Paul working with ZDI (coordinated); published May 2024. Scanning: none reported, and not really applicable. Advisory: https://support.apple.com/en-us/120905
Sources: Sekoia, CISA, The Hacker News, Security Affairs, Apple.
CVE-2026-116606: Barracuda Email Security Gateway authentication bypass (with CVE-2026-111560)
CVE-2026-116606 lets an unauthenticated attacker restore a crafted backup and change a Barracuda Email Security Gateway’s global configuration. It affects ESG versions before 9.4.0.030, and Barracuda ships it as patches BNSF-40425 and BNSF-40430. The type is an authentication bypass, and companion bug CVE-2026-111560 is a root command injection in the timezone field that also hits ADC, WAF, BMA, WCC and WSG products. An attacker needs network reach to the admin interface, with no login for the first bug and admin rights for the second, which is why SecurityWeek treats them as a chain. The business impact is root on the appliance that handles an organization’s email.
Heads up: CVE-2026-116606 is CVSS v4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVE-2026-111560 is 8.6 (same but PR:H), both from Mandiant. Barracuda’s advisory carries those scores. Neither is on KEV as of the Nov. 6 catalog; EPSS is 0.7% (54th percentile) and 0.5% (41st). Exploit: public PoC REPORTED by TheHackerWire, which lists a watchTowr repo; we didn’t open it. Exploitation: SUSPECTED at most. One TheHackerWire roundup says “targeted exploitation observed” with no source, and neither Barracuda nor Mandiant reports attacks, so don’t repeat that as fact. No campaigns or actors. Access: remote and automatable, no user interaction; Barracuda corrected its advisory Nov. 5 to say no authentication is needed for 116606, only access to the admin UI. Fix: patch, and restrict the admin UI to trusted internal networks; Barracuda says non-public interfaces are less exposed, but that’s a mitigation, not a fix. Version note: Mandiant’s boundaries (9.4.0.030, 9.4.0.27) don’t line up with Barracuda’s patch split at 9.4.017, so confirm patch IDs on the box. Dates: Mandiant’s timeline shows Oct. 15 and Oct. 22 as reports to or by Barracuda (discovery not disclosed); CVEs and advisories Nov. 2, which reads as coordinated. Scanning: none reported. Advisory: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
Sources: Barracuda, Mandiant MNDT-2026-0042, Mandiant MNDT-2026-0041, SecurityWeek, TheHackerWire.
CVE-2026-98432: Linux kernel IPv4 TCP use-after-free
Why now: published Oct. 15, but it became a story in the window: a Go Security Team advisory reached oss-security Oct. 30, Ubuntu’s fixes hit -proposed by Nov. 3, and WatchGuard flagged it Nov. 5.
This is a use-after-free in the code that builds TCP connections over IPv4, triggered by retransmitted SYNs racing against socket setup. It’s been in Linux since 4.4 and is fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. The type is a memory-safety race that can lead to code execution as root, and IPv6 isn’t affected by the SYN race. An attacker sends crafted traffic to an exposed TCP service, and the one demonstrated root exploit targeted a server with an MPTCP listener. The business impact is potential remote root on Linux servers, though real-world reach outside MPTCP isn’t established.
Heads up: CVE-2026-98432 is 9.8 from the kernel CNA (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but Oracle and SUSE score it 8.1 with AC:H and Amazon 7.0; Red Hat’s figures were reported as 5.9 and 8.1 at different points. Not on KEV as of the Nov. 6 catalog; EPSS is 0.76% (56th percentile). Exploit: PRIVATELY held per Canonical, which says Anthropic’s generated exploit is unreleased and no other was known as of Nov. 3. TheHackerWire lists five GitHub repos and a roundup claims weaponized scripts; those are unverified, and repo names suggest audit and mitigation tooling. No known campaigns or actors, and no in-the-wild reports. Access: remote, no auth, no user interaction; Anthropic’s timings were about 48 minutes to leak a pointer, then 5 to get execution, so slow rather than instant. Fix: patch the kernel and reboot. Go 1.24+ programs listen with MPTCP by default on Linux; GODEBUG=multipathtcp=0 is what the Go team calls a “fragile mitigation.” AlmaLinux has suggested dropping inbound TCP with IPv4 options, but traffic between containers on a host can get around it, and init_on_free=1 doesn’t help. Debian, Oracle and Amazon have fixes; Ubuntu was in -proposed Nov. 3 and RHEL 8/9/10 had no listed package Oct. 30, so check your vendor. Dates: credited to Xinyang Ge of Anthropic; kernel fix Oct. 5, CVE Oct. 15, Anthropic’s post Oct. 27; embargo process not described. Scanning: none reported. Advisory: https://security-tracker.debian.org/CVE-2026-98432
Sources: The Hacker News, oss-security (Go), oss-security (mitigations), SecurityOnline (Ubuntu), Debian, SecurityWeek.
CVE-2026-58868: Google Android Framework heap buffer overflow
This is a memory-corruption bug in Android’s FrameDecoder component that could allow remote code execution. It affects Android 14, 15, 16, 16-qpr2 and 17, and it’s fixed at security patch level 2026-11-01 or later. The type is a heap buffer overflow causing an out-of-bounds write in onOutputReceived, needing no extra privileges. Google’s records say no user interaction is required but don’t say how an attacker reaches it. The business impact is possible code execution on employee phones, depending on how fast each manufacturer ships the patch.
Heads up: CVE-2026-58868 is 9.8 in the NVD record (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and Critical from Google, a rating The Hacker News notes assumes platform protections are off or bypassed. Not on KEV as of the Nov. 6 catalog; EPSS is 0.39% (33rd percentile). No known exploit, public or private, and no exploitation flagged in Google’s bulletin as of its Nov. 6 update. No campaigns or actors. Access: remote and zero-click per the record, with the delivery path not disclosed, so we can’t say whether it could be automated at scale. Fix: patching is required and no workaround is published. It isn’t in the Google Play system update list, so check the Android security patch date on the device and push MDM compliance to 2026-11-01 or, better, 2026-11-05, which covers the whole bulletin of 216 flaws. Dates: reporter and discovery not disclosed; bulletin published Nov. 2, updated Nov. 6; CVE published Nov. 2; normal vendor bulletin release. Scanning: none reported. Advisory: https://source.android.com/docs/security/bulletin/2026/2026-11-01
Sources: Android bulletin, The Hacker News, NVD.
CVE-2026-111357: Ivanti Connect Secure privilege escalation (with CVE-2026-118527)
Why now: the chain was disclosed Oct. 13 and ran in last week’s Watch, but CISA’s Oct. 30 KEV additions fall inside this window and BleepingComputer’s Nov. 2 report says the attacks date to at least Oct. 1.
CVE-2026-111357 is the root step in a three-bug chain against Ivanti Connect Secure, the remote-access VPN appliance. Ivanti says 22.8R2.6 and 25.1.1.3 fix all disclosed bugs on those branches. The type is privilege escalation, while CVE-2026-118527 is a predictable upload filename issue. An attacker first gets in without a login through CVE-2026-104935, then uses these two to reach root. The business impact is a fully owned VPN gateway, which the actor used to pull LAPS passwords and BitLocker recovery keys from Active Directory.
Heads up: CVE-2026-111357 is 7.0 in NVD (CyberSecurityNews lists 8.8) and CVE-2026-118527 is 4.3; vectors weren’t in the sources we used. BleepingComputer calls 111357 high-severity. Both went on KEV Oct. 30, with due dates of Nov. 2 and Nov. 13, so federal deadlines have passed or are close. EPSS is 0.53% (45th percentile) and 0.82% (58th). A Nuclei template and GitHub PoCs are reported for the chain (PUBLIC, reported). KNOWN campaign: Volexity found UTA0576 chaining it from Oct. 3, and Defused saw entry-bug activity from Oct. 1; Volexity has low confidence on whether it’s criminal or espionage. Remote over the internet as a chain, no auth, no user interaction, scriptable (the actor re-ran it for every command, no malware or web shell). Patching is required; the actor scrubbed logs so Ivanti’s Integrity Checker came back clean, so don’t trust a clean result. Dates: discovered by Volexity during incident response, disclosed Oct. 13 in coordination with Ivanti; final fix Oct. 29. Scanning: not specifically reported, though Shadowserver tracks over 5,000 exposed instances. Advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
Sources: BleepingComputer, Volexity, The Hacker News, CyberSecurityNews.
CVE at a glance
- CVSS
- 8.1 High (v3.1)
- EPSS
- 1% chance of exploitation in the next 30 days (higher than 63.4% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Nov 9, 2026
- Public exploit
- Yes, reported in 28 GitHub repositories
- CVSS
- 8.1 High (v3.1)
- EPSS
- 1.2% chance of exploitation in the next 30 days (higher than 67.2% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Nov 3, 2026
- Public exploit
- Yes, reported in 5 GitHub repositories
- CVSS
- 7.5 High (v3.1)
- EPSS
- 0.6% chance of exploitation in the next 30 days (higher than 50% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Nov 6, 2026
- Public exploit
- Yes, reported in 2 GitHub repositories
- CVSS
- 8.8 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 22% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 1 GitHub repository
- CVSS
- 5.5 Medium (v3.1)
- EPSS
- 1.4% chance of exploitation in the next 30 days (higher than 72.8% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Nov 4, 2026
- Public exploit
- None reported in public exploit databases
- CVSS
- 9.3 Critical (v4.0)
- EPSS
- 0.7% chance of exploitation in the next 30 days (higher than 54.3% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.