CISA adds four flaws exploited in the wild to its KEV catalog

Threat actors are actively weaponising four high-severity vulnerabilities across OpenSSH, FreeSWITCH, IBM Aspera Faspex and GPUStack, with CISA adding all four to the Known Exploited Vulnerabilities (KEV) catalog on 9 November 2026. The exploits are already observed in the wild, prompting a KEV-driven patch deadline for federal agencies and network operators to apply fixes by 12 November 2026.

The four CVEs are CVE-2026-102895 (GPUStack), CVE-2026-116779 (SignalWire FreeSWITCH), CVE-2026-123158 (OpenSSH), and CVE-2026-123218 (IBM Aspera Faspex). CVSS scores are listed as 9.8 for three of the flaws and 8.1 for OpenSSH’s issue; three of the four have confirmed exploitation, with CVE-2026-123218 noted as not exploited in the wild at the time of reporting.

OpenSSH before 10.6p2 on musl-based systems without PAM, such as Alpine Linux, is affected by CVE-2026-123158, enabling unauthenticated access via a password handling edge case. GPUStack suffers a separate authentication bypass (CVE-2026-102895) via a same-host reverse proxy or a forged X-GPUStack-Real-IP header to gain admin rights.

FreeSWITCH (CVE-2026-116779) enables code execution through a SIP message handling flaw, while IBM Aspera Faspex (CVE-2026-123218) allows an authorised user to bypass access checks and seize full admin control. The advisory urges updating to OpenSSH 10.6p2, FreeSWITCH 1.11.3, GPUStack 2.2.0, and Faspex beyond 5.0.19. If patching immediately is not possible, the guidance includes disabling sshd password logins and removing the X-GPUStack-Real-IP header at proxies.

Claims are attributed to CISA KEV notes and the reporting outlet, with explicit reference to exploited status and patch availability as stated in the source article.