CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV
Original title: U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog
Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog. GPUStack before 2.2.0 lets unauthenticated attackers gain administrator access by spoofing a local origin, with exploitation seen on 2.1.1. FreeSWITCH before 1.11.3 allows code injection via SIP MESSAGE requests, and OpenSSH before 10.6p2 can bypass authentication on musl Linux without PAM. IBM Aspera Faspex 5.0.0 through 5.0.19 is fixed in 5.0.19 PL1.
Unconfirmed: The reporter found no public confirmation of in-the-wild exploitation for the IBM Faspex flaw, despite its KEV listing.
- GPUStack CVE-2026-102895 scores 9.8 and was exploited on version 2.1.1.
- FreeSWITCH CVE-2026-116779 can run OS commands as the FreeSWITCH process.
- OpenSSH CVE-2026-123158 affects musl builds without PAM and scores 8.1.
- Faspex CVE-2026-123218 requires an authenticated user and is fixed in 5.0.19 PL1.
- No threat group is named for any of the four flaws.
Impact: Authentication bypass, admin takeover, or code execution on affected products
| Product | Affected | Fixed in |
|---|---|---|
| GPUStack | before 2.2.0 | 2.2.0 |
| SignalWire FreeSWITCH | before 1.11.3 | 1.11.3 |
| OpenBSD OpenSSH | before 10.6p2 | 10.6p2 |
| IBM Aspera Faspex | 5.0.0 through 5.0.19 | 5.0.19 PL1 |
- 1.Upgrade GPUStack to 2.2.0, FreeSWITCH to 1.11.3, and OpenSSH to 10.6p2.
- 2.Update IBM Aspera Faspex to 5.0.19 PL1.
- 3.FCEB agencies must remediate the listed KEV flaws by the stated due date.
- Vendors
- IBMSignalWireOpenBSDGPUStack
- Products
- FreeSWITCHOpenSSHAspera Faspex
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102895 | Authentication bypass in GPUStack before 2.2.0 | 9.8 | <1% | KEVPoC | KEV |
| CVE-2026-116779 | Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message() | 9.8 | 2% | KEVPoC ×2 | KEV |
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.