CISA Adds Four Exploited Flaws to KEV, Sets Nov. 12 Patch Deadline

CISA added four actively exploited vulnerabilities to its KEV catalog on Nov. 9, giving federal agencies until Nov. 12 to remediate affected systems and complete forensic triage.

The Cybersecurity and Infrastructure Security Agency (CISA) added four actively exploited vulnerabilities affecting GPUStack, FreeSWITCH, OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 9.

Covered federal civilian agencies have until Nov. 12 to remediate the flaws and complete the required forensic triage. The vulnerabilities can allow attackers to bypass authentication, gain administrative access, or execute commands on affected systems, according to CISA's announcement .

All four have confirmed exploitation, although CISA has not identified the attackers or disclosed the number of affected organizations. Administrators should prioritize vulnerable systems and check for unauthorized access, particularly where attackers may have created accounts or credentials that remain valid after patching.

Four exploited vulnerabilities added to CISA's KEV catalog

GPUStack: CVE-2026-102895

GPUStack versions before 2.2.0 contain a critical authentication bypass that can grant remote attackers administrator access without credentials.

According to the GPUStack advisory , the application could incorrectly treat remote requests as trusted local traffic. Attackers could exploit certain reverse-proxy configurations or manipulate the X-GPUStack-Real-IP header.

Successful exploitation allows attackers to create administrator API keys, modify AI inference backends, access cloud credentials, and execute commands on worker systems.

The vendor documented an attack against a GPUStack 2.1.1 deployment in which malicious inference backends were used to launch reverse shells.

FreeSWITCH: CVE-2026-116779

FreeSWITCH 1.11.2 and earlier contain a critical command-injection flaw affecting SIP MESSAGE handling.

The SignalWire advisory explains that specially crafted messages can reach the application's internal API command interface.

Attackers who can deliver a SIP MESSAGE to an affected profile may execute commands, access configuration files and credentials, or manipulate calls. Depending on authentication settings, exploitation may require access to a SIP account.

SignalWire confirms exploitation in the wild. The vulnerability carries a CVSS score of 9.8 and was fixed in FreeSWITCH 1.11.3.

OpenSSH: CVE-2026-123158

The OpenSSH vulnerability can allow authentication bypass on certain Linux systems using musl libc without Pluggable Authentication Modules (PAM).

Affected configurations include Alpine Linux environments. The flaw does not affect every OpenSSH installation.

CISA's KEV listing confirms active exploitation. The vulnerability was also covered in eSecurity Planet's recent report on the Alpine Linux SSH authentication bypass.

Administrators should verify their Linux distribution, OpenSSH version, and authentication configuration before determining exposure.

IBM Aspera Faspex: CVE-2026-123218

IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain a critical authorization bypass that could allow attackers to gain full administrative privileges.

IBM rates the vulnerability CVSS 9.8.

The IBM security bulletin describes an attack involving an authenticated user, although its CVSS vector specifies that no privileges are required. The bulletin does not explain the discrepancy.

IBM fixed the vulnerability in Faspex 5.0.19 PL1. Administrators must also verify the deployed faspex-core container image.

CISA's KEV addition confirms that the flaw has been exploited.

How to fix the vulnerabilities and check for compromise

CISA's Nov. 12 deadline applies to covered federal civilian agencies under Binding Operational Directive 26-04. Private organizations are not bound by the same deadline but should prioritize remediation because all four vulnerabilities have been exploited.

Administrators should follow the affected vendors' instructions and investigate possible compromise.

1. GPUStack: Upgrade and review administrator access

Upgrade to GPUStack 2.2.0 or later.

Until patched, enable force_auth_localhost=true , restrict API access, and prevent untrusted clients from supplying the X-GPUStack-Real-IP header.

Review administrator accounts, API keys, inference backends, and worker configurations.

Revoke unauthorized API keys and rotate potentially exposed cloud or worker credentials.

GPUStack's advisory confirms that attackers can create persistent administrator keys. Upgrading the software does not automatically revoke those credentials.

2. FreeSWITCH: Patch and inspect SIP configurations

Upgrade to FreeSWITCH 1.11.3 or later.

Confirm that enable-chat-api-proto remains disabled on SIP profiles unless explicitly required.

Disable inbound SIP chat with enable-chat=false where the functionality is unnecessary.

Review SIP MESSAGE traffic, configuration changes, and suspicious process activity.

SignalWire warns that MESSAGE authentication alone does not eliminate the vulnerability. Administrators should also remove unnecessary accounts and review exposed SIP profiles.

3. OpenSSH: Identify affected Linux configurations

Check for OpenSSH installations using musl libc without PAM.

Apply the security update provided by the operating system or distribution maintainer.

Prioritize internet-facing SSH services.

Review authentication logs for unusual login attempts and unexpected successful sessions.

Organizations should confirm whether their systems meet the affected configuration requirements rather than treating all OpenSSH installations as vulnerable.

4. IBM Aspera Faspex: Install the fixed release

Upgrade to Faspex 5.0.19 PL1.

Verify that the faspex-core container uses image version 5.0.19 (1ce4b13, Fix Pack: 1) .

Review administrative accounts, privilege changes, and unusual file-transfer activity.

Investigate unauthorized configuration changes or newly created privileged accounts.

IBM lists no workaround for the vulnerability, making the security update the required remediation.

5. Preserve evidence and verify remediation

CISA requires forensic triage for the four KEV entries under BOD 26-04. Administrators should preserve relevant logs and system evidence, verify that updates are installed across all affected instances, and investigate signs of unauthorized access.

Similar investigation steps were recommended after the recent SonicWall SSLVPN authentication bypass , which CISA added to KEV on Nov. 6.

For internet-facing infrastructure, security teams should also review the period before patches became available. Earlier Citrix NetScaler exploitation required administrators to preserve forensic evidence and investigate compromise alongside remediation.

The FreeSWITCH fix was available before its KEV listing, while GPUStack's documented exploitation included creating malicious backends. Systems running vulnerable versions may have been compromised before CISA issued its warning.

Organizations should complete the updates, review affected systems for unauthorized activity, and revoke any credentials or access established during a compromise.

Also read: CISA previously added seven exploited vulnerabilities affecting AI infrastructure and enterprise software, including LiteLLM, Kestra, and SonicWall.