CISA adds four exploited flaws to KEV; fixes due November 12
November 10: Security Affairs adds affected ranges, an 8.1 OpenSSH score, GPUStack exploitation on 2.1.1, and says three flaws have confirmed exploitation with no named threat group.
CISA requires federal agencies to mitigate exploited FreeSWITCH, Faspex, GPUStack, and OpenSSH flaws by November 12.
CISA added SignalWire FreeSWITCH CVE-2026-116779 to the Known Exploited Vulnerabilities catalog on November 9, 2026, and also listed IBM Aspera Faspex CVE-2026-123218, GPUStack CVE-2026-102895, and OpenSSH CVE-2026-123158, called SSHole. Federal civilian agencies must apply BOD 26-04 mitigations by November 12 or discontinue use. FreeSWITCH before 1.11.3 and Faspex 5.0.0 through 5.0.19, fixed in 5.0.19 PL1, both score 9.8; GPUStack before 2.2.0 was exploited on 2.1.1. The Hacker News reports active exploitation of all four, while Security Affairs says three have confirmed exploitation. SignalWire says FreeSWITCH exploitation was observed; IBM does not mention attacks, and CISA lists ransomware use as unknown.
- FreeSWITCH CVE-2026-116779 is fixed in 1.11.3 and can run commands as the process.
- Faspex CVE-2026-123218 affects 5.0.0–5.0.19 and is fixed in 5.0.19 PL1.
- GPUStack CVE-2026-102895, before 2.2.0, was exploited on version 2.1.1.
- OpenSSH SSHole CVE-2026-123158 affects musl builds without PAM before 10.6p2 and scores 8.1.
- Previdian recorded 22 SSHole attempts from 14 IP addresses since November 6.
- No threat group is named; FreeSWITCH ransomware use is listed as unknown.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026Limited SSHole exploitation attempts begin, according to The Hacker News. · The Hacker News
- Nov 7, 2026GreyNoise records the first SSHole honeypot hit. · The Hacker News
- Nov 9, 2026CISA adds FreeSWITCH CVE-2026-116779 to the KEV catalog. · CISA Known Exploited Vulnerabilities
- Nov 12, 2026Federal agencies must apply BOD 26-04 mitigations or stop use. · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- CISA Known Exploited VulnerabilitiesSets the November 12 deadline and lists ransomware use as unknown.
- The Hacker NewsDetails SSHole miners, metadata queries, a Python C2 agent, and attempt counts.
- SecurityWeekReports 9.8 scores, SignalWire’s exploitation claim, and IBM’s silence.
- Security AffairsGives version ranges, OpenSSH’s 8.1 score, and says no group is named.
- Vendors
- IBMSignalWireOpenBSDGPUStack
- Malware
- TAC Agent
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 2d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA adds SignalWire FreeSwitch code injection to KEV (CVE-2026-116779)
The flaw can expose configuration and credentials, control calls, and execute commands; action is due November 12.
- · 21h ago
The Hacker News
CISA adds exploited OpenSSH, GPUStack, FreeSWITCH, and IBM flaws to KEV
FCEB agencies must apply fixes by November 12; SSHole activity includes miners, metadata queries, and a Python C2 agent.
- · 18h ago
SecurityWeek
CISA says IBM Faspex and FreeSWITCH flaws are exploited in attacks
Agencies must patch CVE-2026-123218 and CVE-2026-116779 within three days; GPUStack and SSHole are also listed as exploited.
- · 6h ago
Security Affairs
CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV
Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102895 | Authentication bypass in GPUStack before 2.2.0 | 9.8 | <1% | KEVPoC | KEV |
| CVE-2026-116779 | Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message() | 9.8 | 2% | KEVPoC ×2 | KEV |
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |