CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

The cybersecurity landscape is constantly evolving, and as of today, November 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about four significant vulnerabilities. These flaws affect widely-used software, including OpenSSH and GPUStack, and have been confirmed to be actively exploited. Understanding these vulnerabilities is crucial for anyone concerned about cybersecurity.

What Are the Vulnerabilities?

CISA has added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

1. CVE-2026-123218: This vulnerability is found in IBM Aspera Faspex. It allows an authenticated user to bypass authorization, leading to privilege escalation. This means that a user could gain higher access rights than intended. The flaw was fixed in November 2026.

2. CVE-2026-116779: This is a code injection vulnerability in SignalWire FreeSWITCH. It can lead to unauthorized access and control over communications. Attackers could inject malicious code, potentially disclosing sensitive information. A fix was released in October 2026.

3. CVE-2026-123158 (known as SSHole): This vulnerability affects OpenBSD OpenSSH on Linux systems. It allows attackers to bypass authentication, which could grant them unauthorized access to systems. A fix was made available in November 2026.

4. CVE-2026-102895: This flaw in GPUStack allows unauthenticated users to gain administrative access. This could lead to unauthorized changes to user settings and even execution of arbitrary code. The issue was fixed in July 2026.

Active Exploitation

The addition of these vulnerabilities to the KEV catalog indicates that they are not just theoretical risks; they are actively being exploited in the wild. For instance, since November 6, 2026, there have been multiple attempts to exploit the SSHole vulnerability, with 22 attempts recorded from 14 unique IP addresses. This highlights the urgency for users and organizations to address these vulnerabilities promptly.

Defused Cyber noted that while there is some activity targeting SSHole, it is not widespread yet. However, the potential for exploitation is significant, as confirmed by various cybersecurity firms observing post-exploitation activities. These include attempts to read password hashes and modify SSH keys for persistent access.

Recommendations

CISA recommends that federal agencies apply the necessary fixes for these vulnerabilities by November 12, 2026. This is crucial for protecting sensitive systems and data from unauthorized access.

Conclusion

In summary, the recent warnings from CISA regarding vulnerabilities in OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex illustrate the critical nature of cybersecurity today. Organizations must remain vigilant and proactive in applying security updates and monitoring for potential exploitation.

Merits

• Increased Awareness: Highlighting these vulnerabilities raises awareness about cybersecurity risks.
• Timely Fixes: Encourages organizations to apply patches quickly, reducing the risk of exploitation.
• Protection of Sensitive Data: Helps safeguard sensitive information from unauthorized access.

Demerits

• Potential for Exploitation: Active exploitation poses a real threat to organizations that do not act quickly.
• Resource Intensive: Applying fixes and monitoring for threats can require significant resources.
• Ongoing Threat Landscape: Cyber threats are constantly evolving, requiring continuous vigilance.

Caution

This article is intended for educational purposes. Any placeholder values must be replaced with actual data, and readers should verify claims against the original source before relying on them.

Frequently asked questions

• What is CISA? — CISA stands for the Cybersecurity and Infrastructure Security Agency, which is responsible for protecting the nation's critical infrastructure from cyber threats.
• What are known exploited vulnerabilities? — These are security flaws that have been identified and confirmed to be actively exploited by cyber attackers.
• How can I protect my systems from these vulnerabilities? — Regularly update your software and apply security patches as soon as they are available.
• What is CVE? — CVE stands for Common Vulnerabilities and Exposures, a list of publicly known cybersecurity vulnerabilities.
• Why is it important to fix vulnerabilities quickly? — Quick fixes reduce the window of opportunity for attackers to exploit these vulnerabilities.
• What should organizations do if they are affected? — Organizations should immediately apply patches and monitor their systems for any signs of exploitation.

Tags

#cybersecurity #vulnerabilities #CISA