CVE-2026-123158: Hackers Target OpenSSH SSHole Flaw Instantly

Security researchers have reported that threat actors are actively attempting to exploit a recently disclosed OpenSSH vulnerability. The flaw allows unauthorized sign-ins to accounts that do not have a password set, with exploitation attempts beginning just hours after public disclosure.

• The vulnerability is tracked as CVE-2026-123158 and codenamed SSHole (or sshole).
• It carries a CVSS severity score of 8.1 out of 10.
• The flaw enables sign-ins to accounts with no password configured.
• It impacts Linux systems running OpenSSH on musl C library with disabled PAM.

Details of the SSHole Vulnerability

The security issue affects specific Linux system configurations running OpenSSH. For an exploit to succeed, the target must run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Under these conditions, the authentication logic flaw allows bypassing standard checks.

Researchers from Previdian revealed that attackers quickly targeted public disclosures. Honeypot systems set up by researchers were successfully compromised within hours, allowing malicious actors to gain root privileges on the targeted servers.

What This Means for Administrators

The rapid emergence of exploitation attempts highlights the speed at which threat actors weaponize new vulnerabilities. System administrators managing Linux environments are urged to review their server configurations immediately.

If your infrastructure relies on musl C library deployments with PAM disabled, applying security patches and checking for accounts without passwords is critical to prevent full system compromise and root access breaches.