SB2026110670 - Authentication bypass in OpenSSH

Description

This security bulletin contains information about 1 vulnerability.

1) Improper authentication (CVE-ID: CVE-2026-123158) Exploited

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass password authentication and gain unauthorized access.

The vulnerability exists due to improper authentication in system functionality exposed through OpenSSH sshd when handling password authentication requests. A remote attacker can exploit the authentication flaw through sshd to gain access without successfully completing password authentication.

The issue affects some Linux systems where sshd is built and run with PAM support disabled.

Remediation

Install update from vendor's website.

References

• https://www.openssh.org/releasenotes.html#10.6p2
• https://hachyderm.io/@damienmiller/117563026759098135