The US Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are already exploiting each one. The additions were made on Monday, 9 November 2026, and US federal civilian agencies must apply the fixes by Thursday, 12 November 2026.

The KEV catalog only lists flaws where CISA has evidence of attacks in the wild, so the four entries are not theoretical risks. Three of the four carry a CVSS severity score of 9.8 out of 10, close to the maximum rating.

What the four flaws are

CVE-2026-123218 is an incorrect authorisation flaw in IBM Aspera Faspex, the company’s high-speed file transfer product, rated 9.8. An authenticated user can craft a specific message to bypass authorisation checks and escalate privileges. IBM fixed the flaw in November 2026.

CVE-2026-116779 is a code injection flaw in SignalWire FreeSWITCH, the open-source phone system software, also rated 9.8. Exploiting it can expose configuration files and credentials, give an attacker control over calls, and allow commands to be run on the server. It was fixed in October 2026.

CVE-2026-123158, known as SSHole, is an authentication bypass in OpenBSD OpenSSH running on Linux, rated 8.1. When a server has accounts with no password set, the flaw can let an attacker sign in anyway. It was fixed in November 2026, and it is the flaw on this list with the most visible exploitation so far: researchers recorded 22 exploitation attempts from 14 unique IP addresses since 6 November, with the first attempt against GreyNoise’s honeypot network arriving on 7 November at 00:46 UTC.

CVE-2026-102895 is an improper authentication flaw in GPUStack, an AI model management platform, rated 9.8. An unauthenticated attacker can gain full administrative access, including changing users and models, creating persistent administrator API keys, reading worker and cloud-provider secrets, and running code through a single API endpoint. It was fixed in July 2026, but active exploitation in the wild had already been reported.

What to do now

Organisations running any of the four products should patch first and then check for signs that attackers were already present. The 12 November deadline applies formally to US federal civilian agencies, but the exploitation evidence behind the KEV listing applies to every other user of the same software too. CISA’s guidance for catalogued flaws is to apply the vendor fix, or discontinue use of the product if no mitigation is available.

Administrators should prioritise internet-facing OpenSSH servers and any GPUStack installations exposed to untrusted networks, then work through FreeSWITCH and IBM Aspera Faspex systems. After patching, teams should review administrator accounts and API keys created on affected systems, since access gained before the fix does not disappear when the patch is installed.