CISA Adds Four Known Exploited Vulnerabilities to Catalog

Summary

The Hacker News reports that CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, 2026: CVE-2026-123218 in IBM Aspera Faspex, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 in OpenSSH on Linux, and CVE-2026-102895 in GPUStack. Their reported consequences range from authenticated privilege escalation to authentication bypass and command execution. The evidence does not establish a common operator or a single campaign linking the four flaws.^[0]

OpenSSH has the most detailed exploitation reporting in the supplied material. The article attributes 22 attempts from 14 unique IP addresses since November 6 to Previdian, and separately attributes confirmed post-exploitation activity from six source IP addresses across 18 attack chains to GreyNoise. Reported behavior includes reconnaissance, cloud-metadata queries, credential-access attempts, SSH-key persistence attempts, and at least one deployment of TAC Agent. These are separately attributed observations, not a consolidated victim count.^[0]

GPUStack exploitation was reportedly acknowledged in a July 31 advisory, but the article supplies no comparable operational narrative for it. For FreeSWITCH and IBM Aspera Faspex, the article explicitly notes the absence of public details about exploitation methods, operators, and scale. Fixes are reported as available for all four products, and the article recommends a November 12, 2026 remediation deadline for Federal Civilian Executive Branch agencies.^[0]

Confidence is constrained by source coverage: the substantive exploitation, severity, and patch details are available only through the supplied Hacker News article. The supplied CISA page extract stops within site navigation, so it cannot independently validate those details. Linked vendor advisories and telemetry sources are referenced by the article, but their contents were not supplied.^[0][9]

Attack chain

1. 1. Exploitation of OpenSSH authentication bypass: The article reports in-the-wild exploitation of CVE-2026-123158, an OpenSSH-on-Linux authentication-bypass flaw. It describes exploitation attempts beginning November 6 and subsequent confirmed post-exploitation observations. The supplied evidence does not explain the exact request construction or vulnerable authentication code path.^[0]
2. 2. Post-exploitation activity on OpenSSH targets: Reported activity after exploitation includes reconnaissance, cloud-metadata queries, attempts to read password hashes and root SSH keys, and attempts to modify authorized_keys for persistent access. At least one case involved deployment of TAC Agent, a Python-based command-and-control agent supporting shell commands, reconnaissance, directory enumeration, file transfer, and self-update. Botnet and cryptocurrency-miner activity was reported separately. The evidence does not establish an ordering among these behaviors or show that they all occurred in the same intrusion.^[0]

Disclosure timeline

How it works

IBM Aspera Faspex — CVE-2026-123218: The reported weakness is incorrect authorization. An already authenticated user can craft a specific message to bypass authorization checks and escalate privileges. The supplied evidence does not identify the affected message format or the authorization check involved.^[0]

SignalWire FreeSWITCH — CVE-2026-116779: The article identifies a code-injection vulnerability with potential configuration and credential disclosure, arbitrary call control, and command execution. It does not provide the injection entry point, payload format, or exploitation prerequisites.^[0]

OpenSSH on Linux — CVE-2026-123158, SSHole: The article attributes authentication bypass to an unexpected status code or return value. It does not supply enough technical detail to reconstruct the failure path or establish the precise vulnerable release and configuration combinations.^[0]

GPUStack — CVE-2026-102895: Improper authentication reportedly permits unauthenticated administrative access. The resulting capabilities include user and model changes, creation of persistent administrator API keys, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. The evidence describes these capabilities but does not provide a request-level exploit sequence.^[0]

Affected versions and patch status

Key takeaways

• The four vulnerabilities have different exploitation prerequisites and consequences. In particular, the reported Faspex issue requires an authenticated user, whereas GPUStack reportedly permits unauthenticated administrative access; the KEV grouping should not erase those distinctions.^[0]
• OpenSSH has the strongest operational detail in this evidence set, but the reported counts describe separate telemetry views. They do not establish a global exploitation total, a victim count, or a named actor.^[0]
• The supplied article contains behavioral hunting leads but no literal attacker IP addresses, domains, or file hashes. An empty indicator list avoids presenting vulnerability identifiers, legitimate telemetry domains, or a generic SSH filename as compromise evidence.^[0]
• Treat the reported patch months as patch-availability information, not deployment-ready version guidance. Exact affected and fixed versions remain unresolved in the supplied evidence, and the truncated CISA extract does not provide independent confirmation.^[0][9]

Defensive actions

• Prioritize the reported fixes for IBM Aspera Faspex, FreeSWITCH, OpenSSH on Linux, and GPUStack. For Federal Civilian Executive Branch remediation planning, use the article's stated November 12, 2026 deadline, while validating applicable fixed releases against the relevant vendor advisory.: The article reports active exploitation and available fixes for all four vulnerabilities, but supplies no authoritative affected-version ranges or fixed release numbers.^[0]
• On potentially exposed OpenSSH systems, investigate reconnaissance, cloud-metadata queries, attempted reads of password hashes or root SSH keys, and unexpected authorized_keys modifications.: These behaviors are specifically reported as SSHole post-exploitation activity. Authorized_keys modification was described as an attempt to obtain persistent access.^[0]
• Include TAC Agent and botnet or cryptocurrency-miner activity in investigations of potentially exploited OpenSSH hosts; distinguish the reported deployment from the agent's listed capabilities.: The article reports at least one TAC Agent deployment and separately relays watchTowr observations involving botnets and miners. TAC Agent is described as Python-based and capable of shell execution, reconnaissance, directory enumeration, file transfer, and self-update, but no hashes or infrastructure are supplied.^[0]
• For potentially exposed GPUStack deployments, review unexpected administrator API-key creation, user or model changes, and requests to POST /v2/inference-backends/from-yaml; assess whether worker or cloud-provider secrets may have been exposed.: These checks follow the administrative, persistence, secret-disclosure, and code-execution capabilities attributed to CVE-2026-102895. They are capability-based investigation leads, not behaviors confirmed in the supplied GPUStack exploitation reporting.^[0]