CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

Actively exploited: added to CISA’s KEV catalog on November 9, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: November 12, 2026.
CERT Santé alert of November 6, 2026: actively exploited.

Description from CISA’s KEV catalog.

Our analyses

Any long enough password unlocks some OpenSSH servers on Alpine Linux

The OpenSSH flaw patched on November 5, trivial to exploit on musl-based Linux such as Alpine, is now being exploited, according to CISA. Who is exposed, and the setting to change until you can update.

Nov 6, 20265 min read

Alerts and vulnerabilities from CERT Santé, the French healthcare CERT

CVSS 8.1ExploitedNov 6

OpenSSH - CVE-2026-123158

Patch availableWorkaround available

What to do

Check whether your estate includes OpenBSD OpenSSH, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (alpinelinux.org)
Vendor advisory or reference cited by CISA (github.com)
NVD entry (NIST)
CISA KEV catalog