OpenSSH SSHole vulnerability is being actively exploited

Within hours of the disclosure of a critical security vulnerability in OpenSSH, cybercriminals began actively exploiting it. The vulnerability, classified as CVE-2026-123158 and codenamed SSHole, allows attackers to log into systems that have not set a password for user accounts. According to the security company Previdian, this vulnerability particularly affects Linux systems using OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled.

The security rating of this vulnerability is 8.1 on the CVSS scale, making it a serious threat to affected systems. The discovery of the vulnerability and the subsequent attacks have drawn the attention of security experts, who are now trying to assess the impact and scope of the attacks. The fact that attackers responded so quickly to the vulnerability suggests that they have extensive knowledge of the OpenSSH architecture.

Details of the Vulnerability and the Attacks

The SSHole security vulnerability allows attackers to log into systems without a password, posing a significant risk to the integrity and confidentiality of the data. This type of vulnerability is particularly dangerous as it enables attackers to gain full control over the affected system. The attacks were initially carried out on honeypots specifically set up to monitor and analyze malicious activities.

The honeypots used by security experts to simulate and study attacks were quickly identified and attacked by hackers. The fact that these attacks occurred so soon after the disclosure of the vulnerability shows that the threat actors are well-organized and have the necessary resources to carry out such attacks. Security experts warn that attacks on real systems will not be long in coming if they do not respond quickly enough.

The vulnerability specifically affects systems using the musl C library, meaning not all Linux distributions are affected. Nevertheless, the number of affected systems is significant, as many servers and applications rely on OpenSSH to enable secure connections. The use of PAM is a common practice to ensure additional security, and disabling this feature significantly increases the risk.

Reactions from the Security Community

The security community has reacted with concern to the discovery of the SSHole vulnerability. Many experts are calling for immediate action to address the vulnerability and ensure that systems affected by this flaw are quickly patched. Discussions in forums and social media show that many administrators and security experts are aware of the urgency to review and update their systems as necessary.

Some security experts have already begun publishing specific guidelines for securing OpenSSH installations. These guidelines focus on how administrators can configure their systems to minimize the risk of an attack. The rapid response of the security community is crucial to limit the impact of this vulnerability and ensure the security of the systems.

The SSHole security vulnerability is another example of the challenges facing the IT security industry. Given the constant threats from cybercrime, it is essential for companies and organizations to take proactive measures to protect their systems. The discovery of this vulnerability and the subsequent attacks highlight the need for continuous monitoring and improvement of security practices.