The Exploit Bulletin — Saturday, November 7, 2026: 2 issues require action
Saturday, November 7, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: OpenSSH sshd · SonicWall SonicOS
1. sshd password authentication bypass on musl libc systems without PAM (CVE-2026-123158)
AUTHENTICATION BYPASS · CRITICAL · CVSS 8.1
GreyNoise and press reports from 2026-11-06 describe attackers scanning for and successfully exploiting this bypass within hours of disclosure, with root obtained on an Alpine honeypot, so an exposed musl-based sshd that still allows password logins can be logged into by anyone who sends a long junk password.
OpenSSH sshd before 10.6p2 on Linux built against musl libc without PAM misinterprets whether a stored string is a password hash, so for some account configurations any password between 256 and 1024 characters is accepted. Alpine Linux, OpenWrt with OpenSSH installed instead of the default Dropbear, and other musl-based embedded systems are affected, and a successful login can land the attacker directly in a root or system account.
Affected: OpenSSH sshd before 10.6p2 on Linux with musl libc and no PAM (Alpine Linux default, OpenWrt, musl-based embedded and container images)
How to Test: Identify hosts and container images running sshd on musl-based Linux (Alpine, OpenWrt) and confirm the OpenSSH version is 10.6p2 or later; anything older with password authentication enabled is exposed. Review sshd authentication logs for accepted password logins, especially on accounts with no password set or on service/root accounts, from unfamiliar source addresses since 2026-11-05, and treat any such login as a compromise.
How to Patch: Upgrade OpenSSH to 10.6p2 or later (update the openssh package on Alpine and other musl-based distributions and rebuild affected container images). Where the upgrade must wait, disable password authentication in sshd and allow only public-key logins, and restrict SSH reachability from the internet.
Evidence: VulnCheck KEV · GreyNoise live report: scanning, exploitation attempts and successful exploitation of SSHole · The Hacker News: attackers gained root on an Alpine honeypot within hours of disclosure · Help Net Security: OpenSSH flaw exploited in the wild hours after disclosure · VulnCheck XDB public exploit
2. SonicOS SSL-VPN single-factor path bypasses SAML authentication and MFA (CVE-2026-19868)
CISA KEV (due 2026-11-20) · AUTHENTICATION BYPASS · CRITICAL · CVSS 7.5
CISA added this flaw to KEV on 2026-11-06 and SonicWall says it is being exploited, so an organization that leaves SSL-VPN on an unpatched SonicOS build is letting attackers who hold a single set of valid credentials walk past its SAML-enforced MFA.
SonicOS SSL-VPN accepts authentication through an alternate single-factor method, so an attacker holding valid credentials for that method can bypass SAML authentication controls and the MFA that SAML enforces, gaining VPN access as that user.
Affected: SonicWall SonicOS 7.3.3-7015 and older; SonicWall SonicOS 8.2.2-8015 and older (per SonicWall SNWLID-2026-0014)
How to Test: Check the SonicOS firmware version on each firewall with SSL-VPN enabled; any 7.3 build before 7.3.4-7013 or an affected 8.2.2 build is vulnerable. Review SSL-VPN authentication and session logs for successful logins by non-SAML/alternate authentication methods on accounts that are expected to authenticate only through SAML with MFA, and for VPN sessions from unfamiliar source addresses since the advisory date.
How to Patch: Upgrade the 7.3 branch to SonicOS 7.3.4-7013 or later and the 8.2 branch to the fixed build published in SonicWall advisory SNWLID-2026-0014. Until the firewall is upgraded, disable or tightly restrict the alternate (non-SAML) authentication methods on the SSL-VPN, or restrict SSL-VPN reachability to known sources.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Canadian Centre for Cyber Security: SonicWall indicates CVE-2026-19868 is being exploited · BleepingComputer: SSL-VPN MFA bypass exploited in attacks
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
