Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA lists OpenSSH auth bypass in KEV catalog (CVE-2026-123158)

Original title: CISA KEV: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability — OpenBSD OpenSSH (CVE-2026-123158)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 3 sourcesExploited OpenSSH SSHole flaw added to CISA KEV catalogMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Federal agencies must apply vendor mitigations or stop using the product by November 12, 2026.

CISA added CVE-2026-123158, an OpenBSD OpenSSH flaw on Linux involving an unexpected status code or return value, to its Known Exploited Vulnerabilities catalog. The entry says the bug could allow authentication bypass. Agencies must follow BOD 26-04 and vendor instructions, or discontinue use if mitigations are unavailable.

Unconfirmed: The entry does not state affected versions and lists ransomware use as unknown.

Key facts
  • The KEV due date is November 12, 2026.
  • Known ransomware campaign use is listed as unknown.
  • The entry does not name affected or fixed versions.
Security assessment · AI, from the articleExploited in the wild

Impact: authentication bypass

ProductAffected
OpenBSD OpenSSH—
What to do
  1. 1.Apply vendor mitigations and follow CISA BOD 26-04.
  2. 2.Discontinue use of the product if mitigations are unavailable.
Analyze CVE-2026-123158 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-123158
ATT&CK
T1190 Exploit Public-Facing Application
Tags
opensshcisa-kevauthentication-bypasslinuxopenbsd
Vendors
OpenBSD
Products
OpenSSH
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-123158
Password bypass in OpenSSH before 10.6p2 on musl without PAM
8.117%KEVPoC ×16
KEV

From the original article

1 min read at cisa.gov

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.