Act today Critical Known exploited Patch available CVSS 8.1 (NVD)
Moxa responds to OpenSSH password bypass on Linux without PAM
Moxa security advisoriesMoxa, OpenSSHCVE-2026-123158
What happened. A flaw in the OpenSSH server (sshd) before 10.6p2 lets some accounts be opened with any password of 256 to 1024 characters. It applies on Linux using musl libc without PAM, such as Alpine Linux.
Who is affected. Systems running OpenSSH before 10.6p2 on Linux with musl libc and no PAM, such as Alpine Linux. The source does not say which Moxa products are affected.
What to do. Check whether you run OpenSSH before 10.6p2 on musl libc without PAM, and apply the vendor fix or update OpenSSH where it applies.
When to act. Act today: Moxa product owners: this SSH flaw is known exploited; check devices running this OpenSSH build without PAM.
Editor's reading
Forasset ownerOT security leadvendor/integrator
- Purdue level
- L3.5
- L3
Why: SSH servers on Linux-based gateways and servers are used for remote administration, often in the industrial DMZ (L3.5) or site operations (L3).
- Are you exposed?
Search your asset inventory for Linux hosts using musl libc without PAM, such as Alpine Linux, and check the OpenSSH version is before 10.6p2.
- If you cannot fix it yet
- Restrict SSH access to known management hosts and block it from the corporate network and internet.
- Use key-based logon and disable password authentication in sshd where possible.
- Limit remote SSH to a jump host that requires multi-factor authentication.
- Watch for
- Successful SSH logons using very long passwords, 256 to 1024 characters, in authentication logs.
- SSH logons from unexpected source addresses to devices or servers running Alpine Linux.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Moxa security advisories (opens moxa.com)
Vendor advisory: marc.info
More on Moxa CVE-2026-123158