CISA adds exploited OpenSSH, GPUStack, FreeSWITCH, and IBM flaws to KEV
Original title: CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
FCEB agencies must apply fixes by November 12; SSHole activity includes miners, metadata queries, and a Python C2 agent.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. They affect IBM Aspera Faspex, SignalWire FreeSWITCH, OpenBSD OpenSSH on Linux, and GPUStack. OpenSSH CVE-2026-123158, called SSHole, has drawn limited attempts since November 6, including credential access, authorized_keys changes, TAC Agent deployment, botnets, and cryptocurrency miners. Federal Civilian Executive Branch agencies are told to apply fixes by November 12, 2026.
Unconfirmed: Actors, methods, and scale for the IBM, FreeSWITCH, and GPUStack flaws are not publicly reported; Defused Cyber says SSHole activity is not widespread.
- IBM Aspera Faspex CVE-2026-123218 can let an authenticated user escalate privileges.
- FreeSWITCH CVE-2026-116779 can disclose credentials and execute commands.
- GPUStack CVE-2026-102895 allows unauthenticated admin access and code execution.
- Previdian recorded 22 SSHole attempts from 14 IP addresses.
- GreyNoise saw the first SSHole honeypot hit on November 7, 2026.
Impact: Auth bypass, privilege escalation, RCE, and secret disclosure
| Product | Affected |
|---|---|
| IBM Aspera Faspex | — |
| SignalWire FreeSWITCH | — |
| OpenBSD OpenSSH | on Linux |
| GPUStack | — |
- 1.Apply the vendor fixes; FCEB agencies are told to patch by November 12, 2026.
- 2.Check OpenSSH hosts for authorized_keys changes, metadata queries, and TAC Agent.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.005 Cloud Instance Metadata APIT1552.004 Private KeysT1098.004 SSH Authorized KeysT1496 Resource Hijacking
- Vendors
- IBMOpenBSDSignalWire
- Malware
- TAC Agent
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102895 | Authentication bypass in GPUStack before 2.2.0 | 9.8 | <1% | KEVPoC | KEV |
| CVE-2026-116779 | Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message() | 9.8 | 2% | KEVPoC ×2 | KEV |
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.