U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

CVE-2026-102895 GPUStack Improper Authentication Vulnerability

CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability

CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability

The first issue added to the catalog, CVE-2026-102895 (CVSS score of 9.8), is an improper authentication vulnerability affecting GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. The flaw allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges by making requests appear to originate from the local system. Successful exploitation can expose sensitive information, create persistent administrator API keys, modify configurations and potentially execute arbitrary code. Exploitation has been observed in the wild against a GPUStack 2.1.1 deployment. Security researcher Javier Sixto reported the in-the-wild exploitation, but no specific threat group has been identified. The issue affects versions before 2.2.0.

The second issue, CVE-2026-116779 (CVSS score of 9.8), is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. The flaw allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands. Depending on the configuration, this can expose credentials and configuration data, manipulate telephone calls and execute operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation has been observed in the wild. The vulnerability was added to CISA’s KEV catalog on November 9, 2026, but no information identifying the attackers or a specific campaign has been disclosed. FreeSWITCH versions before 1.11.3 are affected.

The third issue, CVE-2026-123158 (CVSS score of 8.1), is an authentication bypass vulnerability affecting OpenSSH. Under specific conditions, when OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit the flaw by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed. However, no specific threat actor or attack campaign has been publicly identified. OpenSSH versions before 10.6p2 are affected.

The fourth issue, CVE-2026-123218 (CVSS score of 9.8), is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1. I found no public confirmation of exploitation in the wild or information identifying attackers at the time of writing. Versions 5.0.0 through 5.0.19 are affected.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the two vulnerabilities by November 12, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)