CISA adds four actively exploited flaws to its KEV catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four known-exploited vulnerabilities to its KEV catalog, after accumulating evidence of active exploitation. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. The CVEs are CVE-2026-102895 (GPUStack), CVE-2026-116779 (FreeSwitch), CVE-2026-123158 (OpenSSH, aka SSHole), and CVE-2026-123218 (IBM Aspera Faspex).

CISA lists these with high CVSS scores and notes that exploitation activity is underway, with at least some instances showing post-authentication or post-exploitation steps.

Evidence of in-the-wild activity includes multiple exploitation attempts starting from 7 November 2026. Previdian reports a total of 22 exploitation attempts from 14 unique IP addresses. GreyNoise provides detail on initial exploitation attempts against its honeypots (first observed on 7 November 2026 at 00:46 UTC) and notes confirmed post-exploitation activity across six source IPs, comprising 18 distinct attack chains.

The activity collectively involves reconnaissance, queries to cloud metadata services, attempts to read password hashes and SSH keys, and attempts to modify SSH authorized_keys to achieve persistence. In at least one observed case, actors deployed TAC Agent, a Python-based C2 framework enabling shell command execution and other capabilities. WatchTowr and others have also flagged the OpenSSH flaw being used for botnet and cryptocurrency-mining activity.

Intel notes that FCEB agencies have been urged to apply fixes by 12 November 2026. Existing advisories credit researchers for reporting the flaws and confirm that exploitation has been observed for SSHole (CVE-2026-123158) and related weaknesses, while the public scope of exploitation for the remaining CVEs remains unclear.