OpenSSH authentication bypass CVE-2026-123158 disclosed 2026-11-05, active exploitation reported

CHRONOS Cybersecurity & Infrastructure category illustration. Illustrative only, not specific to this event. — Illustrative image, not a photograph of this event.

Urgency: L4
: 60
: 80
: 25
: 30
: 85

At a glance

CVE-2026-123158 was publicly recorded on November 05, 2026 and OpenSSH published Portable 10.6p2 on 2026-11-05. Independent security reports within days describe active exploitation of the vulnerability, increasing the urgency for operators to apply patches or mitigations and investigate possible intrusions.

CVE-2026-123158 disclosed 2026-11-05, OpenSSH Portable 10.6p2 released 2026-11-05, and reporters documented active exploitation within days. Patch or mitigate now.

CHRONOS Wire · November 10 · Alert 19

What happened

A high-severity OpenSSH authentication bypass, tracked as CVE-2026-123158 and disclosed on 2026-11-05, was patched by the OpenSSH project and within days security researchers reported active exploitation attempts. If you run sshd, you should apply vendor or upstream patches and look for signs of unauthorized access.

Why it matters

Independent reports of active exploitation appeared within days of disclosure, raising the risk to unpatched, exposed systems.

CHRONOS Bottom Line

CVE-2026-123158 is a high-severity authentication bypass disclosed on 2026-11-05 and quickly followed by reports of active exploitation; apply patches or mitigations now.

Full detail

What changed

Public disclosure of CVE-2026-123158 on 2026-11-05 and an upstream OpenSSH release on the same date, followed by independent reporter accounts of active exploitation within days.

What is genuinely new

Independent reporting of active exploitation attempts appeared within days after the 2026-11-05 disclosure and upstream OpenSSH release.

Detailed analysis

CVE-2026-123158 was publicly recorded on November 05, 2026 and OpenSSH published a Portable 10.6p2 release on 2026-11-05. Subsequent independent reporting described active exploitation of the vulnerability. Organizations should prioritize applying the upstream or vendor patches and hunt for indicators of unauthorized SSH access.

U.S. Impact

U.S. Impact assessment pending.