Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

A newly disclosed vulnerability in OpenSSH, tracked as CVE-2026-123158 with a CVSS score of 8.1 and codenamed SSHole, is being actively exploited by threat actors within hours of its public disclosure. The flaw allows attackers to sign into accounts that have no password set, effectively enabling unauthorized access. It affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Exploitation has been confirmed on honeypot systems, where attackers successfully gained root access. The rapid exploitation timeline underscores the urgency for affected system administrators to apply mitigations. Research and reporting on the active exploitation was conducted by Previdian. The vulnerability's high CVSS score and ease of exploitation make it a critical threat to unpatched systems.