ThreatRoundup

CVE-2026-123158: OpenBSD OpenSSH (High, CVSS 8.1)

Remote Attacker
Detection content in our coverage: IOCs

CVE record · updated

CVE-2026-123158HighKEVPublic exploitOpenBSD OpenSSH
CVSS
8.1 High (v3.1)
EPSS
1% chance of exploitation in the next 30 days (higher than 63.4% of CVEs)
Exploited in the wild
Yes, on CISA’s KEV list since Nov 9, 2026
Public exploit
Yes, reported in 28 GitHub repositories
Weakness
CWE-394
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Nov 5, 2026
CISA fix-by date
Nov 12, 2026 (for US federal agencies)

What it is

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Description from the National Vulnerability Database.

What to do

CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Check whether you run OpenBSD OpenSSH, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.

Advisories and fixes

ThreatRoundup coverage

Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.