CISA Catalogs Four Vulnerabilities Under Active Exploitation

CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaws affect IBM Aspera Faspex (CVE-2026-123218, CVSS 9.8), SignalWire FreeSwitch (CVE-2026-116779, CVSS 9.8), OpenBSD OpenSSH on Linux (CVE-2026-123158/SSHole, CVSS 8.1), and GPUStack (CVE-2026-102895, CVSS 9.8). Faspex’s flaw allows authenticated users to escalate privileges through crafted messages; FreeSwitch’s code injection can disclose credentials and configuration while enabling arbitrary call control and command execution; OpenSSH’s vulnerability permits authentication bypass; and GPUStack’s flaw grants unauthenticated admin access, enabling user and model modifications, persistent API-key creation, secret disclosure, and code execution.

The OpenSSH vulnerability dominates public exploitation records. Since November 6, 2026, Previdian tracked 22 exploitation attempts from 14 unique IP addresses. GreyNoise detected its first honeypot targeting on November 7, 2026, and identified six source IPs conducting 18 distinct attack chains. Post-exploitation activity included reconnaissance, cloud metadata service queries, attempts to access password hashes and root SSH keys, and SSH authorized_keys modifications for persistent access. One case involved deploying TAC Agent, a Python-based command-and-control tool capable of shell execution, system reconnaissance, directory enumeration, file transfer, and self-updating. watchTowr documented the vulnerability being weaponized in the wild for botnet and cryptocurrency miner operations. Defused Cyber observed on November 7 that exploitation remained limited in scope.

No public reports detail how the three other vulnerabilities are being exploited, who is behind the attacks, or their scope. Patches were released from July 2026 onward. FCEB agencies are recommended to apply patches by November 12, 2026.