CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, covering GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex. The flaws include CVE-2026-123218 in IBM Aspera Faspex (CVSS 9.8, broken authorization enabling privilege escalation), CVE-2026-116779 in FreeSwitch (CVSS 9.8, code injection leading to credential leaks and remote command execution), CVE-2026-123158 in OpenSSH on Linux—nicknamed SSHole (CVSS 8.1, authentication bypass)—and CVE-2026-102895 in GPUStack (CVSS 9.8, flawed authentication allowing unauthenticated admin access and code execution). Researchers at GreyNoise, Defused Cyber and watchTowr report real-world abuse of the SSHole bug for reconnaissance, credential theft, persistence via SSH authorized_keys, botnet building, cryptomining, and deployment of a Python-based C2 tool called TAC Agent, while GPUStack's flaw was separately confirmed as exploited by researcher Javier Sixto. Federal agencies have been told to apply all available patches by November 12, 2026, as the fixes were already released between July and November of this year.