Weekly Recap: OpenSSH SSHole Exploitation Attempts and Other Vulnerabilities
Summary
The roundup reports 20 exploitation attempts from 13 IPs against OpenSSH CVE-2026-123158 (SSHole), which can enable sign-ins to passwordless accounts on Linux systems using musl with PAM disabled, and lists other vulnerabilities.
Key points
- OpenSSH CVE-2026-123158, known as SSHole, has a reported CVSS score of 8.1 and can enable sign-ins to accounts with no password set.
- The flaw affects Linux systems running OpenSSH on musl with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration.
- As of November 9, 2026, 20 exploitation attempts had been recorded from 13 unique IP addresses; the article does not report successful exploitation.
- The roundup lists additional vulnerabilities affecting products including INFINITT PACS, Synology DSM, Android, Xen, Debian apt, WatchGuard, Chrome, and SonicWall.
Article Details
- Event Type
- Weekly cybersecurity news roundup featuring reported exploitation attempts against an OpenSSH vulnerability.
- Impact
- CVE-2026-123158 (SSHole) can enable sign-ins to accounts with no password on affected Linux systems running OpenSSH with the musl C library and PAM disabled. As of November 9, 2026, 20 exploitation attempts had been recorded from 13 unique IP addresses.
CVE
Products
Alpine Linuxthat run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration. As of November 9, 2026, a total of 20 exploitation attemptsOpenSSHOpenSSH Flaw Sees Exploitation Attempts — Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set. The vulnerability,
Countries
Denmark9, 2026, a total of 20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Iran9, 2026, a total of 20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Japana total of 20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Norwayattempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Singaporehave been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Swedenbeen recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.Switzerlandfrom 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.the Netherlands20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.the U.S.IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.