The US Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalogue, warning that all four are being actively exploited. The flaws affect GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex, and US federal civilian agencies have been told to fix them by 12 November 2026.

The addition was made on Monday 9 November. Three of the four flaws carry the highest possible severity score, while the fourth is the OpenSSH authentication bypass nicknamed SSHole, which has drawn the most attention from security researchers.

CVE-2026-123158: SSHole hits OpenSSH on Alpine Linux

The best-known flaw in the batch is CVE-2026-123158, known as SSHole, which scores 8.1 on the CVSS scale. It is an authentication bypass in OpenSSH on Linux systems that use the musl C library without Pluggable Authentication Modules (PAM), a configuration most commonly found on Alpine Linux. An attacker who can reach the SSH service can log in to accounts that have no password set, including root accounts in some setups.

OpenSSH released an emergency fix, version 10.6p2, on 5 November, and Alpine Linux published patched packages for every supported branch the same day. Exploitation attempts began within hours of disclosure. Threat intelligence firm Previdian has recorded 22 exploitation attempts from 14 unique IP addresses since 6 November, while GreyNoise recorded its first attempt against its honeypot network on 7 November and has since seen 18 distinct attack chains from six source addresses.

GreyNoise said the confirmed post-exploitation activity included reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorised_keys file to keep access. In at least one case, an attacker dubbed GT10 deployed a Python-based command-and-control agent called TAC Agent. Security firm watchTowr has also reported seeing the flaw weaponised for botnet and cryptocurrency miner activity, although exploitation is not yet described as widespread.

CVE-2026-102895: GPUStack admin access without a login

CVE-2026-102895 is an improper authentication flaw in GPUStack, the open-source platform for running AI models, and scores 9.8. Versions before 2.2.0 can incorrectly treat remote requests as trusted local traffic, giving an unauthenticated attacker administrator access. That access can be used to change AI inference backends, create persistent administrator API keys, read worker and cloud-provider secrets, and run commands on worker systems.

The GPUStack maintainers disclosed the flaw on 31 July 2026 and credited researchers Nikko Enggaliano, Wei Yunzhou, Rui Yang and Haoyu Wang with reporting it. The advisory also records that attackers had already used the flaw against a GPUStack 2.1.1 deployment, using malicious inference backends to launch reverse shells. The fix is GPUStack 2.2.0 or later.

CVE-2026-116779: FreeSWITCH code injection

CVE-2026-116779 is a code injection flaw in SignalWire FreeSWITCH, the open-source telephony platform, and also scores 9.8. FreeSWITCH 1.11.2 and earlier are affected. Specially crafted SIP MESSAGE traffic can reach the application's internal API command interface, allowing an attacker to disclose configuration files and credentials, take arbitrary control of calls, and execute commands.

SignalWire has confirmed exploitation in the wild. The flaw was fixed in FreeSWITCH 1.11.3, released in October 2026. Administrators are advised to upgrade, check that chat API access remains disabled on SIP profiles unless it is explicitly needed, and review SIP MESSAGE traffic and configuration changes for signs of compromise.

CVE-2026-123218: IBM Aspera Faspex privilege escalation

The fourth flaw, CVE-2026-123218, affects IBM Aspera Faspex versions 5.0.0 through 5.0.19 and scores 9.8. It is an incorrect authorisation vulnerability that can allow an authenticated user to craft a specific message to bypass authorisation checks and gain administrative privileges.

IBM fixed the flaw in Faspex 5.0.19 PL1 and has told administrators to verify that the faspex-core container is running the corrected image. IBM lists no workaround, so installing the fixed release is the required remediation.

What organisations should do now

CISA has not identified the attackers behind the exploitation of these flaws, and has not disclosed how many organisations have been affected. For the three flaws other than SSHole, there are no public reports yet describing how the exploitation is being carried out or at what scale.

The 12 November deadline applies to covered US federal civilian agencies under Binding Operational Directive 26-04, which also requires forensic triage of the affected systems. Private organisations are not bound by that deadline, but security advisers say they should treat the same date as a priority because all four flaws are confirmed as exploited.

Patching alone may not be enough. In the GPUStack case, attackers can create administrator API keys that survive an upgrade, so administrators should review administrator accounts, API keys, inference backends and worker configurations, and revoke anything unauthorised. The same check for unexpected accounts and credentials applies to the other three products, and any internet-facing system running a vulnerable version should be treated as a priority.

Sources: The Hacker News and eSecurity Planet.