The U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on November 9, citing evidence of active exploitation. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex, putting organizations running vulnerable deployments at risk of unauthorized access, command execution or elevated privileges.
CISA’s alert makes these remediation priorities for affected organizations. Public technical accounts describe attacks against OpenSSH on Linux and GPUStack, while the FreeSWITCH issuer advisory also confirms exploitation in the wild.
The four catalog additions are:
- CVE-2026-102895, GPUStack: improper authentication allowing administrative access without credentials. The issuer identifies versions before 2.2.0 as affected and recommends 2.2.0 or later.
- CVE-2026-116779, SignalWire FreeSwitch: code injection that can expose configuration and credentials, give attackers control over calls, and execute commands.
- CVE-2026-123158, OpenBSD OpenSSH: an unexpected status code or return value flaw, known as SSHole, that can bypass authentication on Linux.
- CVE-2026-123218, IBM Aspera Faspex: incorrect authorization allowing an authenticated user to send a specially crafted message and elevate privileges.
The Hacker News reported CVSS severity scores of 9.8 for the GPUStack, FreeSwitch and Faspex flaws, and 8.1 for SSHole. It dates their fixes to July, October, November and November 2026, respectively.
OpenSSH attacks include attempts to retain access
The Hacker News reported that Previdian had recorded 22 SSHole exploitation attempts from 14 unique IP addresses, with attempts dating to November 6. Defused Cyber said in a November 7 post that it had observed a small number of actors targeting the flaw and that activity was not yet widespread.
GreyNoise placed the first attempt against its honeypot network—systems used to observe attacks—at 00:46 UTC on November 7. It reported confirmed activity after exploitation from six source IP addresses, representing 18 distinct attack chains.
Those chains included reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to change the SSH authorized_keys file to retain access. In at least one case, attackers deployed TAC Agent, a Python command-and-control program capable of running shell commands, gathering system information, listing directories, transferring files and updating itself.
The report also cited watchTowr observations of SSHole exploitation for botnet and cryptocurrency-mining activity.
GPUStack can mistake remote traffic for a local administrator
The GPUStack advisory describes a trust failure in get_current_user, in gpustack/api/auth.py. Before version 2.2.0, requests treated as coming from loopback—the host’s own local network address—automatically received the built-in administrator identity when force_auth_localhost was False, its default value.
Two paths could trigger that behavior. In a typical self-hosted deployment with a reverse proxy on the same machine forwarding to 127.0.0.1, remote requests arrived at GPUStack with a local socket address. No credentials or forged header were needed. The advisory says this path was verified end to end against HEAD 6bee5883. Alternatively, an attacker could supply X-GPUStack-Real-IP: 127.0.0.1 to make a request appear local.
That access allowed attackers to inspect and change users, models, workers and configuration; read worker credentials and cloud-provider secrets; and create persistent administrator API keys with scope ["*"], usable subsequently from any source IP. Administrative features including POST /v2/inference-backends/from-yaml could then execute code on worker hosts.
The maintainers report exploitation against a 2.1.1 deployment, where attacker-created custom backends ran reverse shells, giving attackers remote command access. They credit independent reports from Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University, with active exploitation reported by Javier Sixto of Ulex Innovative Systems. The Hacker News dates the advisory to July 31.
FreeSWITCH chat messages can reach command interfaces
The FreeSWITCH advisory explains that sofia_presence_handle_sip_i_message() splits the destination user in an incoming SIP MESSAGE at +, treating the left portion as a chat protocol selector. SIP is a signaling protocol used by calling systems.
The mod_dptools module registers an api chat interface that passes its address to switch_api_execute(). A peer able to get one MESSAGE accepted can therefore select a FreeSWITCH API command. Commands run with the FreeSWITCH process’s privileges, allowing operating-system command execution, credential and configuration disclosure, and full call control. When mod_lua is loaded, as in the stock configuration, inline Lua code can also reach the full standard library.
Inbound chat is enabled unless a profile sets enable-chat=false; the stock internal and external profiles leave it enabled. Tightening the inbound access-control list does not remove exposure because that list does not cover MESSAGE traffic.
Where MESSAGE authentication is enforced, one ordinary account with registration permission is sufficient. Some stock configurations also permit access without an attacker-owned account: conf/vanilla/directory/default/default.xml defines a default user without a password or a1-hash, which authenticates unless allow-empty-password is false for that user.
The fix introduces a per-profile enable-chat-api-proto setting, disabled unless explicitly enabled. Blocked attempts to select api receive a 403 response and generate a log containing the source and requested command. The check is case-insensitive; messages without a selector or using other chat protocols retain their routing. The setting ships commented out in the vanilla profiles and mod_sofia sample. The advisory credits Örn Arnarson and Gunnlaugur.
What administrators should do
GPUStack administrators should upgrade to 2.2.0 or later, which removes automatic loopback administrator access and hardens client-address handling. The maintainers’ workarounds are to set force_auth_localhost=true, prevent proxies from presenting external requests as loopback, strip client-supplied X-GPUStack-Real-IP headers at the edge, and restrict API access through a VPN or edge authentication.
FreeSWITCH administrators should apply the issuer’s fix or set enable-chat=false on every profile that does not need inbound SIP chat. That workaround disables all inbound MESSAGE chat delivery on those profiles.
Authentication alone does not close the FreeSWITCH command path. MESSAGE authentication has been enabled by default since 1.10.7; combined with removing every directory user lacking both password fields—including the stock default and Skinny example users—it only reduces exposure to authenticated command execution. Likewise, disable_system_api_commands=true removes the system API but leaves other APIs reachable, including module loading and call origination.
For U.S. Federal Civilian Executive Branch agencies, CISA’s Binding Operational Directive 26-04 requires rapid prioritization of KEV flaws on publicly exposed assets where exploitation grants total control, and establishes expectations for checking whether compromise preceded patching. The Hacker News reports a November 12 remediation date for these additions; that date concerns federal civilian agencies. CISA encourages other organizations to prioritize KEV remediation through risk-based vulnerability management.
