Increased scanning activity detected for Sshole vulnerability (CVE-2026-123158)
Security researchers are observing a rise in automated attempts to exploit the Sshole vulnerability via SSH.
Summary
The SANS Internet Storm Center has reported a surge in scanning activity targeting the Sshole vulnerability, identified as CVE-2026-123158. This increase in exploitation attempts was detected through the deployment of Cowrie honeypots, which monitor SSH-based attacks.
While the data collected provides evidence of active scanning, the researchers noted limitations in the captured credentials. Because the honeypots are configured to collect only the first 255 characters of SSH passwords, the full scope of the credentials being used in these attempts remains partially obscured.
Vulnerability scanning observations
- Vulnerability Identifier: The activity is specifically targeting CVE-2026-123158, known as the Sshole vulnerability.
- Detection Method: Researchers utilized Cowrie honeypots to capture and analyze incoming SSH traffic and exploitation attempts.
- Data Constraints: Honeypot logging is limited to the initial 255 characters of any password provided during the SSH handshake.
Why it matters
System administrators managing SSH services should prioritize patching against CVE-2026-123158 to prevent unauthorized access. The rise in automated scanning indicates that this vulnerability is being actively weaponized in the wild.
Original reference: isc.sans.edu →