Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability

For more information, read the full story at the original source: The Hacker News ↗

Vulnerabilities in this story

• CVE-2026-102895 KEV · fix by 2026-11-12 gpustack gpustack EPSS 0.5% 9.8Critical
• CVE-2026-116779 KEV · fix by 2026-11-12 signalwire freeswitch EPSS 2.1% 9.8Critical
• CVE-2026-123218 KEV · fix by 2026-11-12 IBM Aspera Faspex EPSS 0.7% 9.8Critical
• CVE-2026-123158 KEV · fix by 2026-11-12 OpenBSD OpenSSH EPSS 16.5% 8.1High

Also reported by

• Security Affairs: U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog ↗
• SecurityWeek: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks ↗
• Ars Technica: Vulnerability that lets hackers SSH into Linux devices is under active exploitation ↗
• BleepingComputer: Hackers exploit SSHole OpenSSH flaw to breach Linux systems ↗