2026-11-08 — OpenSSH SSHole CVE-2026-123158

Threat Overview

Previdian reported successful root login to an Alpine Linux honeypot following oversized-password authentication attempts. The underlying OpenSSH flaw permits a failed password hash operation to match the disabled-password marker in certain musl/no-PAM configurations. It is not a universal SSH authentication bypass.

References

– 2026-11-06: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html?m=1
– 2026-11-05: https://thehackernews.com/ (OpenSSH emergency patch coverage)

Impacted Systems

OpenSSH portable sshd on Linux with musl libc, PAM disabled, password authentication enabled, and accounts with disabled password hashes; Alpine Linux default openssh-server configuration is relevant. Internet-accessible TCP/22 increases exposure. OpenSSH 10.6p2 and distribution backports fix the issue. glibc/PAM configurations, Dropbear, and non-Linux systems are not affected by this mechanism.

Why this matters

Recent verified reporting indicates a potentially consequential enterprise threat. Layered Sentinel hunting can surface related activity where supporting logs are ingested.

Exploitation Status

Confirmed exploitation attempts and a successful honeypot root login reported by Previdian; no confirmed enterprise victim population. Published source IP 89.116.89.18 is contextual, not exhaustive.

What this hunt looks for

No customer-specific Sentinel telemetry was reviewed during report preparation. The following queries are designed to assess authentication, system and endpoint process behavior, network traffic, and persistence where those data sources are ingested.

Required logs

This is a prepared hunt package, not a completed customer workspace investigation. Conclusions are limited to the tables and retention actually ingested into Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored hosts or in non-ingested logs.

Accepted password authentication on SSH hosts

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has "sshd" or SyslogMessage has "sshd"
| where SyslogMessage has "Accepted password for"
| project TimeGenerated, Computer, SyslogMessage, ProcessName

Accepted password for root or service identities

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "Accepted password for"
| where SyslogMessage has_any ("root", "alpine", "service", "backup")
| project TimeGenerated, Computer, SyslogMessage

SSH authentication activity from published attack IP

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "sshd" and SyslogMessage has "89.116.89.18"
| project TimeGenerated, Computer, SyslogMessage

SSH access followed by privileged utility execution

let SSH=Syslog | where TimeGenerated >= ago(14d) and SyslogMessage has "Accepted password for" | project Computer, LoginTime=TimeGenerated, LoginMessage=SyslogMessage;
let Cmd=Syslog | where TimeGenerated >= ago(14d) and SyslogMessage has_any ("doas", "sudo", "useradd", "adduser") | project Computer, CmdTime=TimeGenerated, CmdMessage=SyslogMessage;
SSH | join kind=inner Cmd on Computer | where CmdTime between (LoginTime .. LoginTime+30m) | project Computer, LoginTime, CmdTime, LoginMessage, CmdMessage

SSH server process spawning recon commands

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("sshd","sshd-session")
| where FileName in~ ("id","uname","hostname","whoami","sh","bash")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName

New authorized_keys changes after suspicious SSH logons

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName == "authorized_keys" or FolderPath has "/.ssh/"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName

SSH lateral connections to new remote hosts

let Base=DeviceNetworkEvents | where TimeGenerated between (ago(30d)..ago(2d)) and RemotePort == 22 | summarize by DeviceId, RemoteIP;
DeviceNetworkEvents | where TimeGenerated >= ago(2d) and RemotePort == 22 and isnotempty(RemoteIP) | join kind=leftanti Base on DeviceId,RemoteIP | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

Detection Notes

The highest-value first pass is the initial query when the required data is ingested; correlate with asset inventory before attributing activity. Generic process, network, and administrative events can reflect legitimate operations. DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents require endpoint telemetry ingested into Sentinel; Syslog requires forwarding; CommonSecurityLog requires suitable network or HTTP fields. A missing table or absent process command line is a visibility gap, not a negative result. No query can establish patch level without separate inventory. Syslog usually does not record password length; Accepted password is a triage signal, not proof of CVE exploitation.