SSH 'Sshole' Vulnerability Sees Surge in Exploitation Attempts
Honeypot data reveals a significant increase in scanning and exploitation attempts targeting the 'sshole' vulnerability in SSH, with attackers using unusual password techniques.
Security researchers are observing a notable uptick in malicious activity targeting the 'sshole' vulnerability (CVE-2026-123158) affecting SSH services. Data collected from SANS Internet Storm Center honeypots indicates that initial scanning for this vulnerability began around November 1st, escalating significantly in the days that followed.
The primary indicator of this surge is the increased use of unusually long passwords during login attempts. Standard brute-force attacks typically involve shorter, more common password patterns. However, the observed activity includes attempts using passwords that are hundreds of characters long, often consisting of repeated characters like 'A's. This behavior is highly indicative of automated exploit attempts trying to leverage the 'sshole' vulnerability.
Researchers noted that the first clear exploit attempts specifically targeting 'sshole' were detected on November 5th. Prior to this, some "buggy" brute-force scripts were observed sending commands intended for the post-login shell within the password field itself. In a concerning twist, these malformed password entries sometimes succeeded, allowing the malicious scripts to execute commands like downloading and running payloads from attacker-controlled servers.
The data, collected by Cowrie honeypots which log the first 255 characters of SSH passwords, shows a dramatic increase from zero attempts before November 1st to over 700 on November 6th. While the exact success rate of these attacks is still under investigation, the sheer volume of scanning and the nature of the exploit attempts suggest that successful compromises are likely occurring.
Analysis of the source IP addresses involved in the scanning reveals a diverse range of origins, including providers like COLT, Datacamp Limited, and B2 Net Solutions Inc., among others. This broad distribution suggests a coordinated or widespread campaign targeting vulnerable SSH servers.
The 'sshole' vulnerability, identified as CVE-2026-123158, is a critical flaw that allows for potential bypasses or unauthorized access to SSH services. While specific technical details of the vulnerability's mechanism are still emerging, the observed exploitation patterns highlight the immediate threat to systems running unpatched SSH software.
Given the observed increase in exploitation and the potential for successful compromise, system administrators are strongly advised to ensure their SSH services are updated to the latest secure versions. Monitoring SSH logs for unusual login attempts, particularly those involving excessively long or malformed passwords, is also a crucial step in detecting and mitigating potential attacks.
Further analysis is ongoing, with researchers aiming to provide more detailed insights into the exploitation methods and the full impact of the 'sshole' vulnerability. The current trend underscores the persistent threat posed by unpatched vulnerabilities in widely used network services like SSH.