CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
Hackers are exploiting a newly disclosed flaw in OpenSSH, known as SSHole, to gain unauthorized access to Linux systems, prompting a warning from CISA.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the active exploitation of a critical vulnerability in OpenSSH, dubbed SSHole, which allows attackers to execute commands, steal credentials, and maintain persistent access on affected Linux systems. This flaw, identified as CVE-2026-123158, has been actively targeted by threat actors since a proof-of-concept exploit was released on November 5, 2026, leading to successful breaches shortly thereafter.
The SSHole vulnerability affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Specifically, it impacts systems like Alpine Linux, which is often used in cloud and virtual environments due to its lightweight nature. The flaw allows attackers to bypass authentication by exploiting a quirk in musl’s password-hashing function. When an oversized password is provided, the hashing function returns an asterisk (*), which OpenSSH mistakenly accepts as a valid password hash, permitting unauthorized access.
Security researcher Ozgun Kultekin disclosed the vulnerability last week, and OpenSSH maintainers promptly released a fix in version 10.6p2 on November 5, 2026. Despite the patch, exploit code became available just hours later, leading to rapid exploitation attempts. Finnish security firm Defused noted that while the activity is not yet widespread, multiple actors have been observed attempting to exploit SSHole. GreyNoise, a threat intelligence company, recorded the first successful exploitation in the wild on November 7, 2026.
The attacks observed by GreyNoise and other firms have involved a range of malicious activities. These include system and container reconnaissance, attempts to access cloud metadata services, and efforts to read password hashes and root SSH keys. In some cases, attackers have modified SSH 'authorized_keys' files to establish persistent access. One notable incident involved the installation of TAC Agent, a Python-based command-and-control tool, although it failed to connect to its server.
The vulnerability does not affect all systems universally. It specifically requires the presence of accounts with an asterisk (*) as their password hash, which is used to disable password logins. Systems using PAM, non-Linux systems, and those based on the glibc library are not affected. However, for those systems that are vulnerable, the consequences can be severe, potentially allowing attackers to gain root access and move laterally within networks.
The agency has advised federal agencies to apply the necessary patches by November 12, 2026. Meanwhile, threat intelligence firm watchTower has observed SSHole being leveraged for botnet and cryptomining operations, indicating the varied motives of attackers exploiting this vulnerability.
What security teams should do
Update OpenSSH to version 10.6p2 or apply the latest patched version from your distribution.
Disable SSH password authentication on vulnerable systems.
Monitor logs for unexpected successful password logins to accounts with an asterisk (*) in the password field.
Investigate unauthorized SSH keys and TAC Agent files or startup services on affected systems.
What remains unknown
The specific identities of the threat actors exploiting SSHole remain unknown.
The full scale of the exploitation and the number of affected systems is not yet clear.
Details on the exploitation of other vulnerabilities added to CISA's catalog are not fully reported.