Hackers log in to Linux systems using any long password: CISA confirms active exploitation of SSHole
Some vulnerable Linux systems allow hackers to log in as root and take full control.
sshole vulnerability. Image by Cybernews, screenshots from sshhole.com.
Follow us
- CISA says attackers are actively exploiting the SSHole flaw in vulnerable Linux systems.
- Any password longer than 256 characters can let attackers access affected passwordless accounts.
- Affected systems include Alpine, OpenWrt, Buildroot, Yocto, and other Linux distributions using musl.
- Federal agencies must apply fixes by November 12 after CISA added the bug to its KEV catalog.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Hackers are logging in to vulnerable Linux systems using any passwords longer than 256 characters, the US Cybersecurity and Infrastructure Security Agency (CISA) warns. Federal agencies have three days to apply fixes.
CISA has confirmed active exploitation of a Linux authentication flaw known as SSHole and added it to its Known Exploited Vulnerabilities (KEV) catalog.
Cybernews previously reported that random long passwords can unlock containers, routers, internet-connected devices, and other Linux systems. A system is vulnerable if it runs the common remote login software OpenSSH on a Linux distribution that uses the musl library and has PAM disabled.
The affected systems include Alpine, OpenWrt, Buildroot, Yocto, and others, often in default configurations. The bug is tracked as CVE-2026-12315 and has a severity score of 8.1 out of 10.
“OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass,” the vulnerability description reads.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
CISA has set November 12 as a deadline for federal agencies to apply mitigation measures.
Several other cybersecurity vendors have already independently confirmed active exploitation of the bug, disclosed last week by security researcher Özgün Kültekin.
Greynoise monitors active exploitation and has already confirmed 6 attacker IPs and 20 cases of post-exploitation activity. Its monitoring system flagged nearly 30 million SSH connection attempts.
Researchers at the SANS Internet Storm Center (ISC) also observed scans targeting the SSHole vulnerability and warned of “an increase in attempts to exploit the vulnerability.”
The exploitation is trivial, as any long string between 257 and 1024 characters will be accepted on vulnerable systems as a valid password for passwordless accounts, including root.
A too-long password causes an error in the musl library and makes it return an asterisk (*) symbol instead of a hash. Accounts with disabled passwords also store an asterisk, which OpenSSH mistakenly matches, letting an attacker in.
OpenSSH released an updated version of its software, even though it considered the root cause of this bug to be outside OpenSSH itself.
