This article is our current position statement on recent CVE reports regarding OpenSSH vulnerabilities.
Applies to: All SNS EVO Storage Systems (EVO v7 and EVO Suite)
Risk Level: None / Not Applicable
Overview
In November 2026, security advisories were disclosed regarding an authentication bypass vulnerability in OpenSSH (CVE-2026-123158, known as "SSHhole").
The vulnerability specifically relies on unique error-handling behavior within the musl C library when OpenSSH processes authentication without PAM.
EVO version 7 does not include the musl C library, and SSH is disabled by default.
Vulnerability Assessment
- CVE-2026-123158 (OpenSSH Authentication Bypass): NOT AFFECTED.
- EVO version 7 does not use the musl C library within the operating environment.
- SSH access is disabled by default across standard EVO deployments, eliminating external exposure to the service.
Customer Action
No action is required. Because the required musl C library component is not present in EVO systems and SSH is disabled by default, systems remain secure against this exploit. No software updates or configuration modifications are necessary for this CVE.