Last updated

Global Event

SSHole (CVE-2026-123158) Activity 2026

GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of CVE-2026-123158, also known as "SSHole," a flaw in OpenSSH on musl-based Linux (such as Alpine) that lets an oversized password authenticate to accounts configured to reject password logins. Due to the encrypted nature of secure shell (SSH), discerning exploitation attempts strictly through network traffic is challenging. As of 6 November, we have confirmed vulnerable gridpoints deployed. Successful exploitation is being tracked as executing shell commands on the vulnerable system.

  1. Published to NVDCVE-2026-123158, CVSS 8.1.
  2. 23h 21m laterEarliest tagged activity2.57.122.150 sent an oversized authentication volume to a GreyNoise gridpoint.
  3. 1h 4m laterFirst oversized-password exploit attempt178.128.25.88, using Paramiko 5.1.0.

Sources: GreyNoise gridpoint sessions and NVD.

Indexed: 304 unique values across ASN, CIDR /24, CVE, HASSH, IP, JA4SSH, JA4T, Tag ID. Searches collected data points only, not report text.
Successful Exploitation (0)

No confirmed successful exploitation against GreyNoise gridpoints yet.

Indicators Associated with Exploitation Attempts

Click any column header to sort; click again to reverse.

Block candidates (0)

malicious + any block-recommended tag (Exploit Attempt) + spoofable:false

IPClassTagsOrgASNCountryCategory / BSIFirst trackedGN first_seenLast seenSpoofablegridpoint_count
Newly Observed Attack Infrastructure (15)
IPClassTagsOrgASNCountryCategory / BSIFirst trackedGN first_seenLast seenSpoofablegridpoint_count
5.83.138.229suspiciousOversized Authentication Byte-VolumeZAP-Hosting GmbHAS206996United Stateshosting2026-11-06 18:21:402022-08-232026-11-01 16:33:04false6
43.224.224.200maliciousOversized Authentication Byte-VolumeAROSSCLOUD INC.AS400619Hong Konghosting2026-11-06 18:21:402019-10-252026-11-03 10:20:39false105
43.224.227.158maliciousOversized Authentication Byte-VolumeAROSSCLOUD INC.AS400619Hong Konghosting2026-11-06 18:21:402026-04-252026-11-05 18:35:46false1
89.116.89.18suspiciousOversized Authentication Byte-VolumeNearoute LimitedAS51847Japanhosting2026-11-06 18:21:402026-11-052026-11-06 03:53:55false8
117.185.176.187maliciousOversized Authentication Byte-VolumeShanghai Mobile Communications Co.,Ltd.AS24400Chinaisp2026-11-06 18:21:402026-07-062026-11-06 05:28:16false191
144.172.112.233maliciousOversized Authentication Byte-VolumeRouterHosting LLCAS14956United Stateshosting2026-11-06 18:21:402026-01-302026-11-05 08:44:50false35
156.225.78.8suspiciousOversized Authentication Byte-VolumeZillion Network Inc.AS54801Taiwanhosting2026-11-06 18:21:402026-11-052026-11-05 17:07:28false1
176.65.139.199maliciousOversized Authentication Byte-VolumeStorm Industries LLCAS219502Germanyhosting2026-11-06 18:21:402026-06-112026-10-28 09:48:28false6407
178.128.25.88maliciousOversized Authentication Byte-Volume + Oversized Password Exploit AttemptDigitalOcean, LLCAS14061SingaporeDigitalOcean2026-11-06 18:21:402020-03-112026-11-06 18:47:52false120
178.251.228.45suspiciousOversized Authentication Byte-VolumeIan David KlemmAS200461Germanyhosting2026-11-06 18:21:402026-10-182026-10-18 10:31:09false1
178.254.33.163suspiciousOversized Authentication Byte-VolumeEVANZO e-commerce GmbHAS42730Germanyhosting2026-11-06 18:21:402026-10-182026-10-18 10:30:41false1
181.16.30.235suspiciousOversized Authentication Byte-VolumeVer Tv S.A.AS27984Argentinaisp2026-11-06 18:21:402026-10-182026-10-18 10:31:21false1
210.22.25.114maliciousOversized Authentication Byte-VolumeChina Unicom Shenzen networkAS17623Chinaisp2026-11-06 18:21:402026-11-062026-11-06 05:24:07false9
212.224.107.115suspiciousOversized Authentication Byte-VolumeUltahost, Inc.AS214036Germanyhosting2026-11-06 18:21:402026-11-062026-11-06 11:21:36false1
213.86.169.133maliciousOversized Authentication Byte-VolumeCOLT Technology Services Group LimitedAS8220United Kingdomisp2026-11-06 18:21:402026-11-052026-11-05 21:31:07false33
Technical Similarity Clustering (0)

These clusters are automatically generated investigative leads, not attribution.

ClusternMembersLinking traitValue (click to copy)Global 7d (checked)GNQL (click to copy)Tags
IP First Seen Versus Related Activity

GreyNoise first_seen relative to when it was related to this activity.

Infra age at entrymalicioussuspiciousTotalIPs
fresh (first seen <= 1 day before entry)23589.116.89.18, 156.225.78.8, 210.22.25.114, 212.224.107.115, 213.86.169.133
2 to 7 days000
8 to 30 days033178.251.228.45, 178.254.33.163, 181.16.30.235
31 to 365 days40443.224.227.158, 117.185.176.187, 144.172.112.233, 176.65.139.199
over 1 year2135.83.138.229, 43.224.224.200, 178.128.25.88
Observed Infrastructure (15)
ipclstagsorgasncccatbsientrygn_first_seenlast_seenspoofablegridpointsgroupworkspacesblock
43.224.224.200maliciousOversized Authentication Byte-VolumeAROSSCLOUD INC.AS400619Hong Konghosting2026-11-06 18:21:402019-10-252026-11-03 10:20:39False105greynoiseFalse
178.128.25.88maliciousOversized Authentication Byte-Volume + Oversized Password Exploit AttemptDigitalOcean, LLCAS14061SingaporehostingDigitalOcean2026-11-06 18:21:402020-03-112026-11-06 18:47:52False120greynoiseFalse
5.83.138.229suspiciousOversized Authentication Byte-VolumeZAP-Hosting GmbHAS206996United Stateshosting2026-11-06 18:21:402022-08-232026-11-01 16:33:04False6greynoiseFalse
144.172.112.233maliciousOversized Authentication Byte-VolumeRouterHosting LLCAS14956United Stateshosting2026-11-06 18:21:402026-01-302026-11-05 08:44:50False35greynoiseFalse
43.224.227.158maliciousOversized Authentication Byte-VolumeAROSSCLOUD INC.AS400619Hong Konghosting2026-11-06 18:21:402026-04-252026-11-05 18:35:46False1greynoiseFalse
176.65.139.199maliciousOversized Authentication Byte-VolumeStorm Industries LLCAS219502Germanyhosting2026-11-06 18:21:402026-06-112026-10-28 09:48:28False6407greynoiseFalse
117.185.176.187maliciousOversized Authentication Byte-VolumeShanghai Mobile Communications Co.,Ltd.AS24400Chinaisp2026-11-06 18:21:402026-07-062026-11-06 05:28:16False191greynoiseFalse
178.251.228.45suspiciousOversized Authentication Byte-VolumeIan David KlemmAS200461Germanyhosting2026-11-06 18:21:402026-10-182026-10-18 10:31:09False1greynoiseFalse
178.254.33.163suspiciousOversized Authentication Byte-VolumeEVANZO e-commerce GmbHAS42730Germanyhosting2026-11-06 18:21:402026-10-182026-10-18 10:30:41False1greynoiseFalse
181.16.30.235suspiciousOversized Authentication Byte-VolumeVer Tv S.A.AS27984Argentinaisp2026-11-06 18:21:402026-10-182026-10-18 10:31:21False1greynoiseFalse
89.116.89.18suspiciousOversized Authentication Byte-VolumeNearoute LimitedAS51847Japanhosting2026-11-06 18:21:402026-11-052026-11-06 03:53:55False8greynoiseFalse
156.225.78.8suspiciousOversized Authentication Byte-VolumeZillion Network Inc.AS54801Taiwanhosting2026-11-06 18:21:402026-11-052026-11-05 17:07:28False1greynoiseFalse
213.86.169.133maliciousOversized Authentication Byte-VolumeCOLT Technology Services Group LimitedAS8220United Kingdomisp2026-11-06 18:21:402026-11-052026-11-05 21:31:07False33greynoiseFalse
210.22.25.114maliciousOversized Authentication Byte-VolumeChina Unicom Shenzen networkAS17623Chinaisp2026-11-06 18:21:402026-11-062026-11-06 05:24:07False9greynoiseFalse
212.224.107.115suspiciousOversized Authentication Byte-VolumeUltahost, Inc.AS214036Germanyhosting2026-11-06 18:21:402026-11-062026-11-06 11:21:36False1greynoiseFalse
Fingerprints with inconsistent GreyNoise counts (0 inconsistent, 0 pending re-check)

GreyNoise search count is lower than the number of tracked IPs this watch sees carrying the value. Such counts are re-checked first on the next run; if a fresh count is still low, GreyNoise datasets disagree (inconsistent) and the count cannot indicate rarity. Either way the trait is excluded from fingerprint linking until the count is at least the tracked-IP total.

None: every linking count is at least the number of tracked IPs carrying the value.

Interactive charts (4)

Hover for IP-level detail, drag to zoom, double-click to reset, click legend entries to toggle series.

Hourly activity: classification and gridpoint hits
Tracked IP growth by snapshot
Infrastructure Providers
Newly tracked IPs by infrastructure age
GreyNoise Tags (3)
LabelNameTag IDIntentionBlockCVEsDiscoveredLast def changeVia
Oversized Password Exploit AttemptOpenSSH CVE-2026-123158 Oversized Password Exploit Attemptcb8a6089-3fb0-4d4a-9860-a15cd365336esuspiciousFalseCVE-2026-1231582026-11-06 18:21:402026-11-06 19:08:23cve:CVE-2026-123158
Oversized Authentication Byte-VolumeOpenSSH CVE-2026-123158 Oversized Authentication Byte-Volumefd562a00-6d62-41f0-a062-f32aa47dc5e2suspiciousFalseCVE-2026-1231582026-11-06 18:21:402026-11-06 19:08:23cve:CVE-2026-123158
Exploit AttemptOpenSSH CVE-2026-123158 Exploit Attempt1ed45f23-9517-4ba9-8d2c-3225e27e95f6maliciousTrueCVE-2026-1231582026-11-06 19:08:232026-11-06 19:08:23cve:CVE-2026-123158
Queries

Tracked tags:

(tag_ids:"cb8a6089-3fb0-4d4a-9860-a15cd365336e" OR tag_ids:"fd562a00-6d62-41f0-a062-f32aa47dc5e2" OR tag_ids:"1ed45f23-9517-4ba9-8d2c-3225e27e95f6")

Blocklist (block-recommended family tags):

(tag_ids:"1ed45f23-9517-4ba9-8d2c-3225e27e95f6") classification:malicious spoofable:false last_seen:30d
Change log (3 events in window)
Time (UTC)KindSubjectDetail
2026-11-06 19:08:23tag_changedOpenSSH CVE-2026-123158 Oversized Password Exploit Attemptrelated_tags: ["OpenSSH CVE-2026-123158 Oversized Authentication Byte-Volume", "OpenSSH CVE-2026-123158 Successful Exploitation"] -> ["OpenSSH CVE-2026-123158 Exploit Attempt", "OpenSSH CVE-2026-123158 Oversized Authentication Byte-Volume"]
2026-11-06 19:08:23tag_changedOpenSSH CVE-2026-123158 Oversized Authentication Byte-Volumerelated_tags: ["OpenSSH CVE-2026-123158 Oversized Password Exploit Attempt", "OpenSSH CVE-2026-123158 Successful Exploitation"] -> ["OpenSSH CVE-2026-123158 Exploit Attempt", "OpenSSH CVE-2026-123158 Oversized Password Exploit Attempt"]
2026-11-06 19:08:23tag_newOpenSSH CVE-2026-123158 Exploit AttemptNew tag in family (cve:CVE-2026-123158), intention malicious, block=True, CVEs ['CVE-2026-123158']