---
title: SANS ISC: SSHole (CVE-2026-123158) exploit attempts on its SSH honeypots rose from Nov 4 and peaked Nov 6 | ctxsec
url: https://ctxsec.com/items/sans-isc-sshole-exploit-attempts-honeypots-peak-nov-6
description: "The SANS Internet Storm Center says its Cowrie SSH honeypots saw a rise in unusually long SSH passwords starting Nov 1, the pattern it associates with SSHole attempts. Daily counts reached 713 on Nov 6, then fell to 246 on Nov 7 and 51 on Nov 8 (partial day). The first real exploit attempts it identified arrived Nov 5, using an all-\"A\" password."
status: "official research (SANS Internet Storm Center honeypot data, Nov 8); counts come from one honeypot set and are not an Internet-wide total"
published: 2026-11-08
---

> The SANS Internet Storm Center says its Cowrie SSH honeypots saw a rise in unusually long SSH passwords starting Nov 1, the pattern it associates with SSHole attempts. Daily counts reached 713 on Nov 6, then fell to 246 on Nov 7 and 51 on Nov 8 (partial day). The first real exploit attempts it identified arrived Nov 5, using an all-"A" password.

[← Cybersecurity News](/news) · [markdown](/items/sans-isc-sshole-exploit-attempts-honeypots-peak-nov-6.md)

official research (SANS Internet Storm Center honeypot data, Nov 8); counts come from one honeypot set and are not an Internet-wide total

2026-11-08

### SANS ISC: SSHole (CVE-2026-123158) exploit attempts on its SSH honeypots rose from Nov 4 and peaked Nov 6

- **What ISC measured:** its honeypots log only the first 255 characters of an SSH password, so its view is limited. Long passwords are rare in normal brute-forcing, so it used them as the signal. Daily long-password counts: Nov 1: 23, Nov 2: 0, Nov 3: 5, Nov 4: 58, Nov 5: 232, Nov 6: 713, Nov 7: 246, Nov 8: 51 (the Nov 8 figure was published mid-day).
- **Not all of it is SSHole:** ISC says the Nov 1 entries do not appear to relate to the exploit. They look like buggy brute-force scripts that paste shell commands, such as a wget/curl download of a `bot.x86_64` binary, into the password field.
- **First exploit attempts:** Nov 5, using an all-"A" password. The top early source networks included COLT, Datacamp, Server-Mania and DMZHOST, along with several Korea Telecom addresses. ISC publishes the full source list.
- **Still to come:** ISC expects many attempts succeeded against its honeypots and says it will follow up with details extracted from them.
- **What to do:** patching and exposure guidance is in our earlier SSHole items. This post is scan and exploitation telemetry, not a new vulnerability.

Sources: [SANS ISC: Scans for Sshole Vulnerability (CVE-2026-123158) (Nov 8)](https://isc.sans.edu/diary/33498)