What happened

On November 9, 2026, CISA added CVE-2026-123158 to the Known Exploited Vulnerabilities (KEV) catalog as "OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability," based on evidence of active exploitation. CISA's description: "OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass."

NVD scores it CVSS 3.1 8.1 and classifies it as CWE-394.

CISA's required action for federal agencies: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." The remediation due date is November 12, 2026, 3 days after the listing. CISA lists ransomware use as unknown.

CISA's entry does not say who is exploiting the flaw or since when. The affected releases, fixes and any workaround are in the vendor advisory linked under Sources.

Why it matters if you run public infrastructure

A KEV listing means exploitation has been observed, not predicted. OpenBSD OpenSSH is commonly exposed to the internet, and internet-facing installs are the first to be found and exploited once a flaw is public.

What to check this week

  1. List every OpenBSD OpenSSH instance reachable from the internet, including appliances or servers kept for a migration and interfaces on non-standard ports.
  2. Check the installed version. OpenSSH: run ssh -V on the server. The vendor advisory linked under Sources names the fixed release for each branch.
  3. Apply the fix. Follow CISA's required action quoted above. The upgrade or mitigation steps are in the vendor advisory linked under Sources.
  4. Look for signs of compromise if the system was exposed before you patched. Check the vendor advisory linked under Sources for published indicators, and review the system's logs from before the patch.
  5. Ask whether it needs to be public at all. An allowlist or VPN in front of a management interface turns the next flaw in it from an emergency into a routine patch.

How Attack Surface Scan covers this

Attack Surface Scan recognizes OpenSSH from the greeting its service sends on connect on hosts under your verified domains, including hosts found through certificate transparency logs. Where the version is visible, the match is against that exact version using NVD's affected ranges, and KEV-listed CVEs like this one are ranked first. When the version is hidden, we report the product but do not guess which CVEs apply. We do not send exploit payloads. See Vulnerability matching for the details.

NVD has not yet published affected-version data for this CVE, which both version and potential matches depend on. Matching starts on its own once NVD adds it, with no rescan setup needed.

This alert was published automatically from the CISA KEV and NVD records within hours of the listing, and says only what those records and our scan catalog state. The vendor advisory linked under Sources has the full details.

Sources