Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA adds four exploited software flaws to its KEV catalogue

Part of the CVE-2026-102895 story · since 5 Nov

Quiet for 2 dayslast report 10 Nov6 articles5 outlets
5 Nov · SecurityOnline first9 Nov10 Nov11 NovNowThis article6th of 6
  • Thu 5 Nov, 04:01 UTC. SecurityOnline, first report. GPUStack authentication flaw exploited to seize AI servers. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds GPUStack authentication flaw allowing admin access to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 07:30 UTC. The Hacker News, its first report on the story. CISA adds four actively exploited flaws to its KEV catalog. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 10:30 UTC. SecurityWeek, its first report on the story. CISA flags IBM and FreeSwitch flaws exploited in attacks. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:00 UTC. Security Affairs, its first report on the story. CISA adds four exploited software flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 6th of 6.

U.S. CISA has added four newly known-exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, covering GPUStack, SignalWire FreeSWITCH, OpenSSH, and IBM Aspera Faspex. The flaws are CVE-2026-102895 (GPUStack improper authentication), CVE-2026-116779 (SignalWire FreeSWITCH code injection), CVE-2026-123158 (OpenSSH unexpected status code or return value on musl-based Linux without PAM), and CVE-2026-123218 (IBM Aspera Faspex incorrect authorisation).

GPUStack is affected in versions prior to 2.2.0, FreeSWITCH in versions before 1.11.3, OpenSSH in versions before 10.6p2, and Faspex 5 versions 5.0.0 through 5.0.19. CVSS scores cited range from 8.1 to 9.8, reflecting high-severity impacts.

For each issue, exploitation has been observed in the wild in at least some deployments. CVE-2026-102895 affects GPUStack 2.1.1, where unauthenticated attackers can bypass authentication to gain administrator access and potentially execute code; the flaw enables obtaining sensitive data, creating persistent API keys, and altering configurations.

CVE-2026-116779 affects FreeSWITCH, allowing crafted SIP MESSAGE requests to invoke FreeSWITCH API commands and, depending on configuration, expose credentials or configuration data, manipulate calls, or run OS commands with FreeSWITCH privileges. CVE-2026-123158 concerns OpenSSH on musl-based Linux without PAM, where a remote attacker can bypass authentication by submitting a crafted password.

CVE-2026-123218 concerns IBM Aspera Faspex 5, where an authenticated user can craft a message that bypasses authorisation checks to gain admin privileges. CISA ordered federal agency remediation by 12 November 2026 under the Reducing the Significant Risk of Known Exploited Vulnerabilities directive, with private organisations urged to review the KEV catalog and patch accordingly.

How the story developed

All 6 articles
Quiet for 2 dayslast report 10 Nov6 articles5 outlets

6 articles from 5 outlets since 5 Nov. Quiet since 10 Nov. This was the 6th report, 6 days after the first.

Now5 Nov101112First reportSecurityOnline · 5 Nov, 04:01This article6th of 6 · day 5CISA alert9 Nov, 17:01 · official
  • Thu 5 Nov, 04:01 UTC. SecurityOnline, first report. GPUStack authentication flaw exploited to seize AI servers. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds GPUStack authentication flaw allowing admin access to KEV. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 07:30 UTC. The Hacker News, its first report on the story. CISA adds four actively exploited flaws to its KEV catalog. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 10:30 UTC. SecurityWeek, its first report on the story. CISA flags IBM and FreeSwitch flaws exploited in attacks. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 23:00 UTC. Security Affairs, its first report on the story. CISA adds four exploited software flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 6th of 6.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Thu 5 NovDay 01
    1. GPUStack authentication flaw exploited to seize AI servers04:01 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 5 days

    Mon 9 NovDay 41
    1. CISA adds GPUStack authentication flaw allowing admin access to KEV17:01 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  3. Tue 10 NovDay 54
    1. CISA adds four flaws exploited in the wild to its KEV catalog01:31 · SecurityOnline · Known exploited CVE
    2. CISA adds four actively exploited flaws to its KEV catalog07:30 · The Hacker News · Known exploited CVE
    3. CISA flags IBM and FreeSwitch flaws exploited in attacks10:30 · SecurityWeek · Known exploited CVE
    4. CISA adds four exploited software flaws to its KEV catalogue23:00 · Security Affairs · Known exploited CVE · This article, 6th of 6

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in