CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

What happened

Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD (security-focused Unix-like operating system) OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws  Ravie Lakshmanan  Nov 10, 2026 Vulnerability / Cyber Attack The U.S. IBM is a software and information technology consulting company based in Armonk.

In a post shared on X on November 7, 2026, Defused Cyber said it "observed a small amount of actors targeting SSHole" but stressed the exploitation activity is not widespread yet.

According to GreyNoise (software that collates data on Internet scanners) , the first exploitation attempt against its honeypot network was observed on November 7, 2026, at 12:46 a.m. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability in IBM Aspera Faspex that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

(Fixed in November 2026) CVE-2026-116779 (CVSS score: 9.8) - A code injection vulnerability in SignalWire FreeSwitch that could result in configuration and credential disclosure, arbitrary call control, and command execution. (Fixed in October 2026) CVE-2026-123158 aka SSHole (CVSS score: 8.1) - An unexpected status code or return value vulnerability in OpenBSD OpenSSH on Linux that could allow for authentication bypass.

(Fixed in July 2026) The addition of CVE-2026-123158 to the KEV catalog follows reports of exploitation attempts targeting the flaw since November 6, 2026.