SSHole OpenSSH Bypass Now Exploited, Patch to 10.6p2

Exploitation of SSHole, a recently patched OpenSSH authentication bypass tracked as CVE-2026-123158, has started. SecurityWeek reported on Nov 9, 2026 that WatchTowr and Previdian both warned of in-the-wild attempts over the weekend. The fix is OpenSSH 10.6p2. Patch first, then restart sshd.

Who is actually exposed

Not every OpenSSH server. Per SecurityWeek, the flaw is a misreading of whether a string is a password hash. Supplying a password between 257 and 1024 characters can get an attacker into accounts that should never accept a password, root included.

The practical condition is a Linux distribution built on the musl libc with PAM disabled. SecurityWeek names Alpine, Buildroot, OpenWrt and Yocto, among others. On glibc systems or PAM-enabled builds, the reported behavior does not apply.

On Alpine, the affected accounts include root, any key-only user created with adduser without a password, the Alpine user in the official tiny-cloud images, and users that come from a directory service through musl-nscd.

Exploitation status

• WatchTowr says only botnets and crypto miners have picked it up so far. Other actors are expected to follow.
• Previdian reports 20 attempts from 13 unique IPs across 9 countries, first seen Nov 6 and last seen Nov 8, 2026.
• GreyNoise and Defused have also reported attempts.

What to do, in order

1. Inventory first. Find anything running OpenSSH on musl: Alpine hosts and containers, OpenWrt routers, Buildroot and Yocto embedded images. These are the ones that matter.
2. Update to OpenSSH 10.6p2 and restart sshd. Alpine urged exactly this last week; a package update without a restart leaves the old daemon running.
3. If you cannot patch today, turn off password authentication (it is on by default in OpenSSH) or disable SSH on exposed systems. Key-only logins close this path.
4. Check logs for unusual login requests, especially unusually long password attempts against root or other passwordless accounts.

Priority call: internet-facing embedded and router-class devices go before internal servers. They are the likeliest to be musl-based, the slowest to get updates, and the first thing botnets scan.

The advisory-level technical detail is left to the OpenSSH release notes and the vendor and researcher write-ups linked above. Related coverage: OpenWrt LuCI root RCE flaws and OpenAM 16.1.4 SSO fixes.