CISA flags exploited OpenSSH and GPUStack flaws, urges rapid fixes

Feeds.4Sysops •IT News • November 10, 2026

CISA has added four vulnerabilities in OpenSSH, GPUStack, SignalWire FreeSWITCH and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing active attacks. Federal civilian agencies are urged to apply fixes by November 12, 2026. The OpenSSH flaw has already been linked to attempts to steal credentials and establish persistent access. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Warns of Active Exploitation of OpenSSH Vulnerability SSHole CISA has identified the SSHole vulnerability (CVE-2026-123158) in OpenSSH as being, allowing remote attackers to bypass authentication and access certain Linux accounts without valid credentials. This flaw affects specific server configurations and has a CVSS score of 8.1, indicating a high severity. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on November 9, 2026, and is urging federal civilian agencies to apply fixes by November 12, 2026. The vulnerability has been linked to attempts to steal credentials and establish persistent access. Additionally, other vulnerabilities in GPUStack, SignalWire FreeSWITCH, and IBM Aspera Faspex were also flagged by CISA, but the focus remains on SSHole due to its active exploitation. 2 sources 72

CISA flags exploited OpenSSH and GPUStack flaws, urges rapid fixes

The full story

Extracted Entities

MITRE ATT&CK (2)

Platforms (4)