CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue on November 9, identifying flaws in OpenSSH, GPUStack, FreeSWITCH and IBM Aspera Faspex. The agency’s official catalogue data records November 12 due dates and forensic-triage requirements for all four.
These are new catalogue entries for previously disclosed flaws. Their inclusion signals evidence of exploitation; it does not demonstrate a shared attacker or campaign.
Four products, different remediation paths
OpenSSH — CVE-2026-123158: OpenSSH 10.6p2 addresses password-authentication bypass affecting some Linux systems using musl with PAM disabled. Administrators should check their distribution’s packages, rather than compare version numbers alone. Alpine’s advisory lists backported fixes and says to restart sshd after updating; replacing the package does not replace the running daemon.
GPUStack — CVE-2026-102895: The maintainers’ advisory identifies versions before 2.2.0 as affected and 2.2.0 as patched. Trusting apparent loopback traffic can grant unauthenticated administrator access, including persistent API-key creation and access to worker or cloud-provider secrets.
FreeSWITCH — CVE-2026-116779: SignalWire’s advisory lists versions through 1.11.2 as affected and 1.11.3 onward as patched. An accepted SIP MESSAGE can reach server command execution. Disabling inbound chat on profiles that do not need it is a documented workaround; message authentication alone does not close the path.
IBM Aspera Faspex — CVE-2026-123218: IBM identifies Faspex 5.0.0–5.0.19 as affected and recommends 5.0.19 PL1. Its bulletin describes an authenticated user gaining administrative privileges and specifies checking the faspex-core image for Fix Pack 1.
The Hacker News identifies US federal civilian agencies as the audience for the November 12 deadline. Other organisations can use the listings to prioritise exposed systems and investigate possible compromise alongside patching. The catalogue marks ransomware-campaign use as unknown for each entry.
