Quick answers
- Is CVE-2026-111239 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111239 being exploited in the wild.
- How severe is CVE-2026-111239?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- <UNKNOWN>.
- Is there a fix for CVE-2026-111239?
- No fixed version is recorded yet. Disable the SSH administration service if not required, or restrict network access to it from trusted administrative clients only and configure the login domain to include only administrative users. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-111239 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-111239?
- Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable the SSH administration service if not required, or restrict network access to it from trusted administrative clients only and configure the login domain to include only administrative users.
Technical details
The SSH administration service performs authentication against a configured login domain but does not enforce role-based access control, allowing any authenticated user to reach the administration shell. The vulnerability requires valid credentials in the login domain and network access to the SSH service, but grants remote code execution as the server process. A fix should implement role verification post-authentication.
Affected products
- <UNKNOWN>
Timeline
- 2026-11-10: disclosed