The US Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, giving federal civilian agencies until Thursday 12 November 2026 to fix them. The additions, made on Monday 9 November and updated on 10 November, cover an AI inference manager, a telephony engine, the remote-login software used on countless Linux servers, and an enterprise file-transfer product.

KEV is the list that matters most to defenders. A severity score estimates how bad a flaw could be; a KEV listing means someone has already used it in a real attack. The three-day deadline leaves almost no room for lengthy change windows, so affected teams need to patch first and document later.

GPUStack: CVE-2026-102895

GPUStack is an open-source tool for managing GPU clusters and serving AI models. CVE-2026-102895 is an improper-authentication flaw in the product. Public reporting puts the affected range at versions before 2.2.0, with 2.2.0 or later carrying the fix. The project’s newest release, version 2.3.0, was published on 23 October 2026, so teams that track upstream releases should already be on a safe build. The risk sits with teams that pinned an older image for stability. A management plane for a GPU fleet can hold model weights, API keys, worker credentials and cloud access, so a broken login check there is a stepping stone to much wider access.

FreeSWITCH: CVE-2026-116779

SignalWire FreeSWITCH is a widely used open-source engine for real-time voice and video, powering carriers, contact centres and communication products since 2006. CVE-2026-116779 is a code-injection flaw in the software. Secondary security reporting names FreeSWITCH 1.11.3 or later as the fixed line and treats 1.11.2 and earlier as affected, although no vendor advisory tied to the KEV entry had been found at the time of reporting. FreeSWITCH is often self-hosted by integrators and carriers, so patching falls on those teams rather than a managed cloud provider, and a voice gateway rarely appears in a software inventory even though it often sits on an internet-facing port.

OpenSSH: CVE-2026-123158

CVE-2026-123158 is an unexpected status code or return value flaw in OpenBSD OpenSSH. In practice it allows a password-authentication bypass on certain Linux systems that use the musl C library without PAM. Portable OpenSSH 10.6p2 was reported to have shipped on 5 November to close it, four days before the KEV listing. The musl detail narrows the exposure: glibc-based distributions that use PAM are not the target profile, while Alpine-style minimal images, containers and some appliances fit it. Teams should sort hosts by their C library and authentication stack before assuming a fleet-wide emergency, and remember that key-only SSH setups take password logic out of play altogether.

IBM Aspera Faspex: CVE-2026-123218

IBM published its security bulletin for CVE-2026-123218 on 7 November, two days before CISA listed it. The flaw is an incorrect-authorisation vulnerability in IBM Aspera Faspex, a file-transfer product. IBM rates it CVSS 9.8 and says Faspex 5.0.19 PL1 has addressed a vulnerability that could allow an authenticated user to craft a specific message to bypass authorisation, causing privilege escalation. Affected versions are 5.0.0 through 5.0.19. IBM tells administrators to confirm that the faspex-core container image reads 5.0.19 with Fix Pack 1. Because Faspex often stores or relays sensitive files, low-privilege accounts, including ones issued to external partners, deserve a review as part of the response.

What to do before Thursday

Federal agencies face a hard date of 12 November for all four entries. Private organisations carry no such mandate, but many treat the KEV list as their own priority queue. The practical steps are the same: find every instance of the four products, apply the fixed versions, restrict management interfaces to trusted networks, and then hunt for signs of earlier compromise, such as changed administrator accounts, API keys or backend settings. CISA’s alert lists identifiers and titles, not exploit details, so public reporting cannot yet say who is exploiting these bugs or against whom.