Today’s Topics:
- Hackers Exploit SSHole OpenSSH Flaw to Compromise Linux Systems
- SonicWall Patches Exploited SSL-VPN Vulnerability That Can Bypass MFA
- How can Netizen help?
Hackers Exploit SSHole OpenSSH Flaw to Compromise Linux Systems
Attackers are actively exploiting a newly disclosed OpenSSH vulnerability that allows unauthorized access to certain Linux systems without valid passwords. The flaw, tracked as CVE-2026-123158 and nicknamed SSHole, affects specific OpenSSH configurations using the musl C library without Pluggable Authentication Modules (PAM). Security researchers observed exploitation attempts shortly after its November 5 disclosure, with successful attacks involving reconnaissance, credential theft attempts, and efforts to establish persistent access.
The vulnerability stems from an authentication handling issue between OpenSSH and musl’s password-hashing function. On affected systems, accounts configured without password authentication may contain an asterisk (*) in their password hash field. When an attacker submits a password longer than 256 bytes, musl’s crypt() function can return that same character as an error indicator. OpenSSH may interpret the matching values as successful authentication, effectively allowing attackers to access accounts that were never intended to accept passwords.
Exploitation requires several conditions, including enabled SSH password authentication, a target account with an asterisk password field, and at least one local account containing a compatible password hash. The issue is particularly relevant to Alpine Linux and potentially other musl-based distributions used in cloud environments, embedded systems, and network appliances. Successful exploitation can provide administrative access if the compromised account has sufficient privileges or can obtain them through local configuration.
Threat intelligence firm GreyNoise documented 16 successful exploitation chains originating from six attacker IP addresses across its monitored environments. The observed activity included system reconnaissance, attempts to access cloud metadata services, searches for stored credentials and SSH private keys, and modifications to authorized SSH keys. In one instance, attackers obtained root privileges and installed a Python-based command-and-control implant known as TAC Agent, although the malware reportedly failed to establish communication with its command server.
Other security researchers, including Previdian, confirmed successful exploitation against vulnerable systems. Early activity has also been associated with botnet operators and cryptocurrency mining campaigns. The availability of public exploit code raises concerns about additional attackers incorporating the vulnerability into automated scanning and compromise operations.
OpenSSH addressed CVE-2026-123158 in version 10.6p2, with Alpine Linux distributing fixes across multiple supported and older releases. Administrators operating affected systems should apply the appropriate security updates and restart the SSH daemon, since installing an updated package alone does not replace an already running service. Disabling SSH password authentication provides an interim mitigation for organizations unable to patch immediately.
Security teams should also review authentication logs for unexpected successful password logins, particularly those involving accounts configured for key-based access. Unauthorized changes to SSH authorized keys, newly created accounts, suspicious startup services, and unusual administrative activity may indicate successful exploitation. Given the confirmed attacks, organizations running exposed SSH services on affected Linux configurations should treat remediation and retrospective investigation as immediate priorities.
SonicWall Patches Exploited SSL-VPN Vulnerability That Can Bypass MFA
SonicWall has released security updates addressing an actively exploited vulnerability in its SonicOS firewall operating system that can allow attackers to bypass SAML authentication controls, including multi-factor authentication (MFA). The flaw, tracked as CVE-2026-19868, affects SSL-VPN deployments configured to use Security Assertion Markup Language (SAML) for authentication and carries a CVSS severity score of 7.1.
The vulnerability involves improper authentication enforcement within the SonicOS SSL-VPN service. According to SonicWall, an attacker possessing valid credentials for an alternate authentication method may be able to bypass the configured SAML authentication process. This could permit remote-access sessions without completing the MFA verification normally enforced by the organization’s identity provider. The issue does not provide unrestricted access without credentials, but it can undermine an important security control intended to protect against compromised passwords.
The exposure is particularly concerning for organizations relying on federated identity services to secure VPN access. SAML authentication commonly redirects users to a centralized identity provider, where additional authentication requirements and conditional access policies can be enforced before a session is established. If the firewall accepts credentials through an alternate authentication path, attackers may be able to establish VPN connections without completing those checks.
SonicWall disclosed the vulnerability in a November 6 security advisory after investigating a report of potential exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, confirming evidence of active exploitation. Federal civilian executive branch agencies have been directed to remediate affected systems by November 20, 2026.
The vulnerability affects SonicOS Gen7 firewalls running version 7.3.3-7015 or earlier and Gen8 firewalls running version 8.2.2-8015 or earlier. SonicWall has released fixes in versions 7.3.4-7013 and later for Gen7 devices and 8.2.3-8015 and later for Gen8 devices. The company has not provided a workaround and recommends upgrading affected appliances as soon as possible.
The same security advisory addresses six additional SonicOS vulnerabilities, including two management interface flaws rated 8.8 that could allow unauthenticated attackers to perform unauthorized operations under certain conditions. Other issues involve buffer overflow vulnerabilities affecting SSL-VPN and TACACS+ services, alongside a password hashing weakness. CVE-2026-19868 remains the most immediate concern due to its confirmed exploitation.
SonicWall has not publicly disclosed the number of affected organizations, the identities of the attackers, or detailed indicators of compromise associated with the reported activity. Organizations using SAML authentication for SSL-VPN access should review recent firewall authentication records and compare successful VPN connections against corresponding identity provider sign-in and MFA events. Successful sessions without matching authentication records warrant further investigation, particularly when associated with unfamiliar source addresses or unusual access patterns.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Leave a Reply