CISA ADDS FOUR ACTIVELY EXPLOITED VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Known Exploited Vulnerabilities / Authentication Security / Code Injection / OpenSSH Security / File Transfer Security
Affected Product(s): GPUStack; SignalWire FreeSWITCH; OpenBSD OpenSSH; IBM Aspera Faspex
CVE(s): CVE-2026-102895; CVE-2026-116779; CVE-2026-123158; CVE-2026-123218
Primary Risks: Authentication bypass, unauthorized administrative access, remote command execution, password-authentication bypass, privilege escalation, credential exposure, and enterprise infrastructure compromise
Threat Status: Active exploitation confirmed by CISA for all four CVEs
Affected Environment(s): GPUStack, FreeSWITCH, OpenSSH, and IBM Aspera Faspex deployments
Affected Versions: GPUStack before 2.2.0; FreeSWITCH before 1.11.3; OpenSSH before 10.6p2 on affected Linux systems using musl libc without PAM; IBM Aspera Faspex 5.0.0–5.0.19
Attack Vector(s): GPUStack — loopback authentication bypass; FreeSWITCH — crafted SIP MESSAGE; OpenSSH — password-authentication bypass under specific Linux configurations; IBM Aspera Faspex — crafted requests bypassing authorization controls
CVSS v3: GPUStack 9.8 Critical; FreeSWITCH 9.8 Critical; OpenSSH 8.1 High; IBM Aspera Faspex 9.8 Critical
CWE: GPUStack CWE-287; FreeSWITCH CWE-77; OpenSSH CWE-394; IBM Aspera Faspex CWE-863
CISA Action: Four vulnerabilities added to KEV on November 9, 2026
Federal KEV Due Date: November 12, 2026
Required Response: FCEB agencies must follow applicable BOD 26-04 risk-based remediation and forensic-triage requirements; CISA urges all organizations to prioritize remediation.

---

The Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 9, 2026, after confirming evidence of active exploitation.

The newly added vulnerabilities are CVE-2026-102895, GPUStack Improper Authentication Vulnerability; CVE-2026-116779, SignalWire FreeSwitch Code Injection Vulnerability; CVE-2026-123158, OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability; and CVE-2026-123218, IBM Aspera Faspex Incorrect Authorization Vulnerability.

CISA identifies vulnerabilities of these types as recurring attack vectors for malicious cyber actors and warns that known exploited vulnerabilities pose significant risks to federal enterprise systems.

Their addition to the KEV Catalog establishes that exploitation is occurring in real-world activity and that organizations should elevate remediation priority accordingly.

---

Vulnerability Details

CVE-2026-102895 — GPUStack Improper Authentication Vulnerability

CVE-2026-102895 is a critical authentication-bypass vulnerability affecting GPUStack versions before 2.2.0. The flaw involves improper trust in requests appearing to originate from the local system. Under affected configurations, attackers can exploit reverse-proxy behavior or manipulate a client-controlled IP header to make remote requests appear to originate from a trusted loopback address, potentially obtaining administrative access without valid credentials.

Successful exploitation can allow unauthorized changes to users, models, workers, and system configuration, as well as the creation of persistent administrative API keys and exposure of sensitive credentials. The vendor’s advisory also documents a path to code execution on GPUStack worker hosts through administrative functionality. Exploitation was observed against a GPUStack 2.1.1 deployment, where malicious custom inference backends were used to execute reverse shells.

The vulnerability carries a CVSS v3.1 score of 9.8, classified as Critical. GPUStack corrected the weakness in version 2.2.0 by removing the affected loopback-based administrative authentication behavior and strengthening client-IP handling. Organizations should upgrade to version 2.2.0 or later, restrict exposure to untrusted networks, and review administrative activity and API keys for evidence of unauthorized access.

---

CVE-2026-116779 — SignalWire FreeSwitch Code Injection Vulnerability

CVE-2026-116779 affects SignalWire FreeSWITCH versions through 1.11.2 and allows malicious SIP MESSAGE traffic to reach internal API-command functionality under vulnerable configurations. The weakness involves the processing of inbound SIP messages, where a specially structured message can select an internal API interface and cause commands to execute with the privileges assigned to the FreeSWITCH process.

Successful exploitation can expose configuration data and credentials, interfere with telephone-call operations, and enable operating-system command execution. The vendor confirms that exploitation has been observed in real-world activity. Default SIP profiles accepting inbound MESSAGE traffic may be exposed, and some configurations can reduce the authentication barrier to exploitation.

The vulnerability carries a CVSS v3.1 score of 9.8, classified as Critical. FreeSWITCH version 1.11.3 introduces protections that restrict the affected API-message routing behavior. Organizations should upgrade to version 1.11.3 or later, disable inbound SIP chat on profiles that do not require it, examine account configurations, and investigate unusual command execution or call-control activity. Authentication controls alone do not necessarily eliminate the vulnerable command-execution pathway.

---

CVE-2026-123158 — OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CVE-2026-123158 is a high-severity authentication-bypass vulnerability affecting OpenSSH before version 10.6p2 under specific Linux configurations using musl libc without Pluggable Authentication Modules (PAM). The weakness involves incorrect handling of password-validation results, potentially allowing unauthorized authentication on affected systems.

According to the published vulnerability record, certain account configurations may accept passwords containing between 256 and 1,024 characters regardless of whether those passwords are valid. Alpine Linux is an example of a distribution that may use musl libc without PAM, although actual exposure depends on the installed OpenSSH build and authentication configuration. This is not a universal vulnerability affecting every OpenSSH installation.

The vulnerability has a reported CVSS v3 score of 8.1, classified as High. OpenSSH released version 10.6p2 on November 5, 2026, incorporating a security workaround addressing the authentication bypass. Administrators should identify potentially affected Linux systems, install the corrected OpenSSH release or applicable distribution security updates, and examine authentication logs for suspicious successful logins or unusual password-based access attempts.

---

CVE-2026-123218 — IBM Aspera Faspex Incorrect Authorization Vulnerability

CVE-2026-123218 is a critical authorization-bypass vulnerability affecting IBM Aspera Faspex versions 5.0.0 through 5.0.19. IBM’s security bulletin explains that a user can craft a specific message to bypass intended authorization controls and potentially obtain full administrative privileges within an affected deployment.

The vulnerability carries a CVSS v3.1 score of 9.8, classified as Critical, and is categorized as CWE-863, Incorrect Authorization. Successful exploitation can undermine separation between user and administrator permissions, exposing sensitive administrative functions within enterprise file-transfer environments.

IBM addressed the vulnerability in Aspera Faspex 5.0.19 PL1. Administrators should apply the vendor’s fix, verify the affected container components have been updated, and review access-control and administrative activity for evidence of unauthorized privilege changes. IBM identifies no workaround or alternative mitigation in its security bulletin.

---

Affected Products and Environments

The four vulnerabilities affect different categories of enterprise infrastructure, including AI computing platforms, communications servers, remote-access services, and managed file-transfer applications. Their exploitation characteristics differ significantly, requiring product-specific assessment rather than a uniform remediation approach.

GPUStack versions before 2.2.0 are affected by an authentication bypass that can provide unauthorized administrative access. SignalWire FreeSWITCH versions through 1.11.2 contain a command-injection weakness involving inbound SIP MESSAGE processing. OpenSSH versions before 10.6p2 require particular attention on Linux systems using musl libc without PAM. IBM Aspera Faspex versions 5.0.0 through 5.0.19 are affected by an authorization flaw that can lead to administrative privilege escalation.

Organizations should identify deployed versions, determine whether vulnerable configurations are present, and prioritize systems accessible from untrusted networks. Particular attention should be given to AI infrastructure management interfaces, externally accessible SIP services, Linux SSH servers, and enterprise file-transfer applications handling sensitive business information.

Vendor-provided corrections are available for all four vulnerabilities. Administrators should validate successful deployment of those fixes and assess systems that may have been exposed before remediation.

---

Operational Impact

The November 9 KEV additions expose organizations to distinct but potentially serious security consequences. GPUStack’s authentication bypass can provide unauthorized administrative access and enable code execution on worker hosts. FreeSWITCH’s vulnerable SIP message processing can expose configuration information, compromise credentials, interfere with communications, and permit command execution.

The OpenSSH vulnerability creates a password-authentication bypass under specific Linux configurations, potentially enabling unauthorized remote access. IBM Aspera Faspex’s authorization flaw can allow an attacker to obtain administrative privileges within an affected file-transfer environment.

These consequences extend beyond service disruption. Unauthorized administrative control can enable persistent access, modification of system configurations, exposure of sensitive information, and additional activity against connected infrastructure. The extent of any actual compromise depends on the specific deployment, attacker actions, and available privileges.

CISA’s confirmation of active exploitation establishes an urgent operational concern. Organizations should apply the applicable vendor fixes while separately examining potentially exposed systems for evidence of earlier unauthorized activity.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog identifies vulnerabilities that have demonstrated real-world attacker use.

Potential additions must have:

• An assigned CVE identifier
• Evidence of exploitation
• Clear mitigation or remediation guidance

The November 9 additions confirm that all four vulnerabilities meet those criteria.

For defenders, KEV status means:

• Active exploitation has been confirmed
• Affected systems require elevated remediation priority
• Publicly exposed assets warrant immediate review
• Organizations should determine whether systems were vulnerable before remediation
• Compromise assessment may be necessary where exposure existed
• Risk decisions should account for real-world exploitation rather than relying solely on severity scoring or patch schedules

---

Federal Response

Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies, emphasizing the rapid remediation of high-risk vulnerabilities affecting publicly exposed assets that could grant attackers total control following exploitation.

CISA added all four vulnerabilities to the Known Exploited Vulnerabilities Catalog on November 9, 2026, with a listed remediation due date of November 12, 2026. The catalog also identifies forensic-triage requirements under BOD 26-04.

Federal agencies must evaluate affected assets against the directive’s applicable risk-based requirements, implement vendor-provided remediation, and conduct required compromise assessments where specified. The directive’s obligations must be evaluated according to the affected asset, exposure conditions, and the applicable implementation guidance rather than treating every installation as subject to identical requirements.

For organizations outside the Federal Civilian Executive Branch, CISA’s recommendation to prioritize KEV vulnerabilities remains important security guidance. Those organizations should establish remediation schedules appropriate to the confirmed exploitation activity, the severity of the vulnerabilities, and the exposure of their own systems.

---

Defensive Guidance

Organizations should begin by identifying whether affected products exist within their environments and whether those systems were exposed during the period of confirmed exploitation.

• Inventory GPUStack, SignalWire FreeSwitch, OpenSSH, and IBM Aspera Faspex deployments.
• Determine whether deployed systems are affected by the listed CVEs.
• Review applicable vendor security guidance for each product.
• Apply available updates, mitigations, or configuration changes.
• Prioritize internet-facing and externally accessible systems.
• Review authentication and authorization activity where applicable.
• Examine administrative activity for unexpected changes.
• Review application, system, and network logs for suspicious behavior.
• Verify that remote-access services are restricted according to least-privilege principles.
• Preserve relevant evidence when compromise is suspected.
• Review connected systems if unauthorized access or code execution is identified.
• Confirm that remediation was successfully applied across production and secondary environments.
• Continue monitoring CISA and vendor guidance for additional technical information.

Organizations should also verify that legacy, staging, testing, branch-office, and externally hosted systems are included in asset inventories and remediation workflows.

---

Compromise Assessment

Applying an update or mitigation addresses the vulnerable condition going forward, but it does not establish that exploitation did not occur before remediation.

Because CISA has confirmed active exploitation of all four vulnerabilities, organizations should assess potentially exposed systems for evidence of unauthorized activity.

Defenders should review available evidence for:

• Unexpected authentication events
• Unauthorized account activity
• Privilege changes
• Unrecognized administrative actions
• Suspicious application behavior
• Unexpected code execution
• Unfamiliar processes or services
• Configuration changes that were not authorized
• Unusual outbound network connections
• Evidence of lateral movement
• Unauthorized access to files or transferred data
• Security-control modifications
• Activity occurring before remediation that cannot be explained by normal operations

Where suspicious activity is identified, organizations should preserve forensic evidence, isolate affected systems where appropriate, rotate exposed credentials, review adjacent systems, and determine whether persistence or additional compromise occurred.

---

30-Day Outlook

The addition of four vulnerabilities across GPUStack, FreeSwitch, OpenSSH, and IBM Aspera Faspex is likely to drive increased remediation and investigative activity during the coming weeks.

The products involved occupy different positions within enterprise environments, ranging from computing and communications infrastructure to remote access and file transfer.

Organizations should expect heightened attacker interest once KEV status publicly confirms that the vulnerabilities have practical value in real-world operations.

During the next 30 days, defenders should focus on completing asset inventories, applying applicable vendor remediation, validating patch deployment, and assessing systems that remained exposed before fixes were installed.

The most important objective is not simply closing the vulnerability. Organizations need to determine whether affected systems were reachable during the exploitation period and whether available telemetry indicates unauthorized activity.

---

TRJ Verdict

CISA’s November 9 addition of CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, and CVE-2026-123218 confirms active exploitation involving four enterprise technologies with documented security consequences.

The vulnerabilities include critical authentication and authorization bypasses, command execution through communications infrastructure, and password-authentication bypass under specific Linux configurations. Vendor advisories identify affected software versions, technical exploitation conditions, and available security fixes.

Three vulnerabilities carry reported CVSS v3 scores of 9.8 Critical, while the OpenSSH vulnerability carries a reported score of 8.1 High. These classifications provide additional context, but CISA’s KEV designation independently establishes that attackers have exploited the weaknesses in real-world operations.

The November 12, 2026 KEV due date places immediate emphasis on federal vulnerability-management obligations under BOD 26-04. Organizations outside the federal government should also prioritize applicable updates and review exposed systems, particularly where administrative functions, communications infrastructure, remote access, or sensitive file transfers are involved.

The immediate priority is to correct affected systems and investigate potential earlier compromise. Applying a security update addresses the vulnerable software condition, but organizations must also determine whether unauthorized access occurred before remediation.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---