CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog

On Monday, Nov. 9, the Cybersecurity and Infrastructure Security Agency placed four actively exploited vulnerabilities on its Known Exploited Vulnerabilities list, requiring federal civilian agencies to remediate them by Thursday, Nov. 12. The catalog now includes SignalWire FreeSWITCH (CVE-2026-116779), GPUStack (CVE-2026-102895), IBM Aspera Faspex (CVE-2026-123218) and OpenBSD OpenSSH (CVE-2026-123158).

CISA only catalogs a flaw after it has evidence that attackers are exploiting it in the wild, and the agency updated the entry on Nov. 10. The four products perform different jobs: GPUStack manages GPU clusters for serving AI models, FreeSWITCH handles voice and video calls, OpenSSH is a remote-login daemon, and Faspex moves large files between enterprises.

CISA classifies the GPUStack flaw as improper authentication; the public record shows releases earlier than 2.2.0 are affected and version 2.2.0 contains the patch. The reported impact suggests a full takeover: an unauthenticated attacker can reach administrative functions, allowing changes to user accounts and models, creation of admin API keys, and reading of worker and cloud provider credentials. A research write-up noted reported exploitation against a 2.1.1 deployment, which is behind the fixed release. On Nov. 9, GPUStack's GitHub releases page listed v2.3.0 as the newest stable version, and a v2.3.1rc1 pre-release appeared the same day.

CISA classifies the FreeSWITCH issue as code injection, and the public record lists affected versions as earlier than 1.11.3. According to researcher write-ups, an authenticated peer can send a crafted SIP MESSAGE to execute commands through the API. Shattered notes this is third-party analysis because CISA's entry does not explain the mechanism. Users who followed SignalWire's earlier advice and stopped at 1.11.2 remain exposed, and Shattered also reported that prebuilt FreeSWITCH binaries now require a SignalWire account as of Oct. 31.

CISA describes the OpenSSH flaw as an unexpected status code or return value. The public record limits the issue to sshd versions older than 10.6p2 on Linux systems using musl libc without PAM enabled. Portable OpenSSH 10.6p2 was released on Nov. 5, four days before CISA added the flaw to the KEV list, giving administrators who track releases a head start. Mainstream Linux distributions commonly rely on glibc and PAM, so the vulnerable population is smaller than the OpenSSH name suggests.

IBM Aspera Faspex CVE-2026-123218 is an incorrect-authorization vulnerability affecting Faspex 5.0.0 through 5.0.19, and records indicate the remedy is to patch the container image to 5.0.19 PL1 with no workaround. Shattered reported finding no Faspex release notes or confirmed product changes in the past three months. The same reporting notes that IBM shipped Aspera Console 3.4.12 on Oct. 13, but that is a separate product and does not fix this flaw.

The Nov. 12 deadline applies to Federal Civilian Executive Branch agencies, not every organization, but many private companies use the KEV list as a patching priority. Defenders should confirm whether they run any of the four products, patch internet-facing systems first, and after patching review authentication logs, SIP MESSAGE traffic, administrator accounts and Faspex transfer logs for signs of earlier compromise.

Update, November 10, 2026

CISA said Tuesday it added six more actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: Cisco BroadWorks CVE-2026-20320, Barracuda Networks multiple products CVE-2026-111560, Openwave Messaging Webtop Media Transcoder CVE-2026-111793, Barracuda Email Security Gateway CVE-2026-116606, Microsoft Office Outlook CVE-2026-124194, and Google Chromium CVE-2026-125350. The agency said these flaws are frequent attack vectors and pose significant risks to federal systems. CISA pointed to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control after exploitation and to check whether threat actors compromised systems before patching. The notice does not list individual due dates for the six CVEs.