CISA KEV adds IBM Aspera Faspex, FreeSWITCH, OpenSSH, GPUStack flaws

What happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026, “based on evidence of active exploitation” CISA. The entries are:

• CVE-2026-102895: GPUStack, improper authentication.
• CVE-2026-116779: SignalWire FreeSWITCH, code injection.
• CVE-2026-123158: OpenBSD OpenSSH, unexpected status code or return value.
• CVE-2026-123218: IBM Aspera Faspex, incorrect authorization.

Details below come from the two news outlets covering the additions. CISA’s own alert lists only the names and types.

GPUStack. Security Affairs describes CVE-2026-102895 (CVSS 9.8) as letting a remote, unauthenticated attacker obtain administrator privileges by making requests appear to come from the local system. Consequences include exposure of sensitive information, creation of persistent administrator API keys, configuration changes and possible code execution. Exploitation was observed against a GPUStack 2.1.1 deployment, reported by researcher Javier Sixto, and no threat group is identified Security Affairs. The Hacker News adds that the maintainers published an advisory on July 31, 2026 and that the fix dates from July 2026 The Hacker News.

FreeSWITCH. Security Affairs describes CVE-2026-116779 (CVSS 9.8) as abuse of specially crafted SIP MESSAGE requests and the API chat protocol to run FreeSWITCH API commands. Depending on configuration, this can expose credentials and configuration data, manipulate calls and run operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed exploitation in the wild, and no attacker or campaign is identified Security Affairs. The Hacker News dates the fix to October 2026 The Hacker News.

OpenSSH (“SSHole”). CVE-2026-123158 (CVSS 8.1) is an authentication bypass. Security Affairs says it applies when OpenSSH runs on Linux with the musl C library and without PAM, where the server may treat password input as a password hash. A remote, unauthenticated attacker could use a crafted password to access affected accounts Security Affairs. The Hacker News reports the following, attributing it to the named firms The Hacker News:

• Previdian recorded 22 exploitation attempts from 14 unique IP addresses since November 6, 2026.
• GreyNoise saw its first attempt on its honeypot network on November 7, 2026, and has confirmed post-exploitation activity from six source IP addresses across 18 distinct attack chains.
• The activity includes reconnaissance, cloud metadata queries, attempts to read password hashes and root SSH keys, and attempts to modify the SSH authorized_keys file.
• In at least one case, an unknown actor dubbed GT10 deployed TAC Agent, a Python-based command-and-control agent.
• watchTowr said it has observed the flaw weaponized for botnet and cryptocurrency miner activity.
• Defused Cyber said on November 7 that the activity was not yet widespread.

IBM Aspera Faspex. CVE-2026-123218 (CVSS 9.8) lets an authenticated user craft a specific message to bypass authorization and potentially gain full administrative privileges, per Security Affairs. IBM disclosed it on November 7, 2026 and released a fix in Aspera Faspex 5.0.19 PL1 Security Affairs.

Where the sources differ.

• CISA lists all four as exploited. Security Affairs says it found no public confirmation of exploitation or attacker information for the IBM flaw. The Hacker News says there are no public reports on how the other three are being exploited or by whom.
• Security Affairs says the OpenSSH entry was added on November 6, while CISA’s alert is dated November 9 and covers all four.
• Security Affairs cites BOD 22-01 and says agencies must fix “the two vulnerabilities” by November 12, 2026. CISA’s alert cites BOD 26-04 and lists four entries. The Hacker News gives the same November 12, 2026 date for FCEB agencies.

Am I affected?

According to Security Affairs Security Affairs:

• GPUStack: versions before 2.2.0.
• FreeSWITCH: versions before 1.11.3.
• OpenSSH: versions before 10.6p2, specifically on Linux with musl and without PAM.
• IBM Aspera Faspex 5: versions 5.0.0 through 5.0.19.

The Hacker News describes the OpenSSH flaw as affecting OpenSSH on Linux The Hacker News. Whether other configurations are affected is not confirmed in the sources.

What to do now

1. Inventory GPUStack, FreeSWITCH, OpenSSH (especially Linux builds using musl without PAM) and IBM Aspera Faspex 5, and compare versions with the list above.
2. Upgrade to the fixed releases named in the sources: GPUStack 2.2.0, FreeSWITCH 1.11.3, OpenSSH 10.6p2, Aspera Faspex 5.0.19 PL1.
3. Prioritize internet-exposed systems. CISA says BOD 26-04 focuses on KEV-listed CVEs on publicly exposed assets that grant total control after exploitation CISA.
4. For OpenSSH, look for the behavior reported by The Hacker News: unexpected changes to authorized_keys, reads of password hashes or root SSH keys, and cloud metadata queries from SSH sessions The Hacker News.
5. For GPUStack, review administrator API keys and stored worker and cloud-provider secrets for unexpected changes. The advisory describes persistent administrator API-key creation and secret disclosure as possible outcomes. Rotating credentials is a precaution not stated by the sources.
6. Check for compromise from before the patch was applied. CISA says BOD 26-04 sets basic expectations for when agencies must do this CISA.
7. Federal Civilian Executive Branch agencies are told to apply fixes by November 12, 2026. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV entries.

Sources

• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog
• The Hacker News: CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
• Security Affairs: U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog