# Scanners exploit new SSH 'Sshole' flaw

Published: 2026-11-08 · Severity: severe
Canonical: https://vorant.io/reports/27dabcfd-aadc-5501-85cb-b322abf9544a/openssh-auth-bypass-flaw-hits-musl-libc-systems
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Honeypots show rapidly rising scanning and live exploit attempts against the newly disclosed 'Sshole' SSH vulnerability (CVE-2026-123158).

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33498

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-123158 as exploited in the wild.

SANS ISC reports a surge in SSH login attempts using abnormally long passwords, tied to the newly disclosed 'Sshole' vulnerability (CVE-2026-123158). Using Cowrie honeypot data, researchers observed a sharp increase in long-password attempts beginning November 1st, peaking at 713 events on November 6th, with the first confirmed exploit attempt (using an all-'A' password) appearing on November 5th. The vulnerability appears related to SSH authentication handling of oversized password inputs, though full technical details are limited by the honeypot's 255-character capture limit.

Separately, the honeypot also captured unrelated 'buggy' brute-force scripts that mistakenly submit post-login shell commands as passwords — in one case a command string that downloads and chmods a binary (bot.x86_64) from an external host, suggesting some brute-forcers are retrieving bot malware payloads when their injection succeeds. The report lists numerous source IPs conducting the Sshole-related scanning, predominantly from hosting/VPS providers and a cluster of Korea Telecom (KIXS-AS-KR) addresses, indicating widespread internet-wide probing rather than a single coordinated campaign.

Defenders running internet-facing SSH services should monitor for authentication attempts with unusually long passwords, patch or mitigate per vendor guidance for CVE-2026-123158 once available, and treat the listed scanning IPs and payload-hosting IP as indicators of active probing or exploitation attempts.

## Mentioned in this report

- Vulnerabilities: CVE-2026-123158 (KEV)
- Malware: bot.x86_64

## Detection guidance (public sample)

### Linux Shell Command Downloading and Making a Binary Executable

ATT&CK: T1105

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects a single shell command line that fetches a file with wget, curl or tftp and also runs chmod. This is the typical bot-payload staging one-liner that SSH brute-forcers run after a successful login. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Shell Command Downloading and Making a Binary Executable
description: Detects a shell invocation whose command line combines a download utility
  (wget, curl, tftp) with chmod, the typical bot payload staging one-liner run by
  SSH brute-forcers after a successful login. Generalises on the download-plus-chmod
  pattern, not on a specific host or filename.
status: experimental
tags:
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_download:
    CommandLine|contains:
    - 'wget '
    - 'curl '
    - 'tftp '
  selection_chmod:
    CommandLine|contains: 'chmod '
  condition: selection_shell and selection_download and selection_chmod
falsepositives:
- Installer or bootstrap scripts that download a binary and chmod it, run via sh -c
  by configuration management
- Administrators manually installing tools from a vendor URL
level: medium
id: 5a6f62f7-be88-55e7-9f1b-1f44e3bf010f
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33498
```

### Download Utility Launched Directly From an SSH Session Command

ATT&CK: T1105

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects sshd directly spawning wget, curl or tftp, or a shell with a download command, as seen when brute-forced SSH access is used to pull malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Download Utility Launched Directly From an SSH Session Command
description: Detects sshd spawning a download utility directly, or a shell whose command
  line invokes one, which is consistent with a remote command executed over SSH after
  a successful brute-force login to fetch a bot payload.
status: experimental
tags:
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_direct:
    ParentImage|endswith: /sshd
    Image|endswith:
    - /wget
    - /curl
    - /tftp
  selection_shell:
    ParentImage|endswith: /sshd
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - 'wget '
    - 'curl '
    - 'tftp '
  condition: 1 of selection_*
falsepositives:
- Administrators or automation (Ansible, CI jobs) running curl or wget remotely over
  SSH
- Remote monitoring scripts that fetch health-check URLs via SSH exec
level: medium
id: 8b297559-26dc-53da-aa51-be02f83df57a
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33498
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Suricata as well. A free account opens them.

Source reporting: https://isc.sans.edu/diary/rss/33498

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4aff5dd2-ec20-5a7d-92f9-790f1a44e91d/scanners-exploit-new-ssh-sshole-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup