OpenSSH, GPUStack, FreeSWITCH, IBM: patch by November 12

CISA on Monday, November 9, 2026, added four flaws to the Known Exploited Vulnerabilities catalog: GPUStack, SignalWire FreeSWITCH, OpenSSH, and IBM Aspera Faspex. Federal civilian agencies have until Thursday, November 12, under Binding Operational Directive 26-04. Three of the four carry a public score of 9.8. OpenSSH is scored 8.1. The due date is the same for all of them.

This desk has already covered the OpenSSH bug, CVE-2026-123158, nicknamed SSHole. The new fact is the catalog, the federal clock, and three products that were outside those earlier briefings.

GPUStack before 2.2.0

CVE-2026-102895 is an authentication failure in the GPUStack package, fixed in version 2.2.0 on July 31, 2026. On a vulnerable build, a network request can be treated as the built-in administrator with no credentials. A common self-hosted layout is exposed: a proxy on the same machine presents outside traffic as local, and the product used to trust that appearance. The access reaches users, models, workers, and configuration. It can mint an administrator key that keeps working from other addresses, and it can expose worker credentials and cloud-provider secrets. From there, administrative functions can run code on worker hosts.

The maintainers credited Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins with independent reports. Javier Sixto of Ulex Innovative Systems reported exploitation in the wild, including against version 2.1.1. A GPUStack server still below 2.2.0 has been missing that fix since July. Move it to 2.2.0 or later. On any host that stayed on the old build and could be reached, rotate administrator keys and cloud credentials, and look for users, models, and inference backends the operator did not create. Until the package is current, require credentials for every connection, including traffic that only looks local, and keep the API off the open internet.

FreeSWITCH through 1.11.2

CVE-2026-116779 is a code-injection bug in SignalWire FreeSWITCH, scored 9.8. CISA’s listing says a vulnerable server can disclose configuration and credentials, control calls, and run commands. SignalWire’s fix is version 1.11.3. Builds through 1.11.2 are in the vulnerable range. Public reporting still has no victim count and no named crew. The catalog entry is the evidence CISA is standing on.

Install 1.11.3 or later. Turn chat off on any phone profile that does not use it. If the server answers from the internet, limit who can reach it. A host that spent time on 1.11.2 or earlier with that service exposed needs a look at call routing and at the credentials stored in its configuration. Rotate those credentials when you cannot account for them. Products that embed FreeSWITCH may ship the same fix under their own version number. Ask the vendor which build contains 1.11.3.

IBM Aspera Faspex 5.0.0 through 5.0.19

CVE-2026-123218 is an authorization bug in IBM Aspera Faspex, scored 9.8. A user who already has an account can become a full administrator. IBM’s fix is 5.0.19 PL1 on Linux. Versions 5.0.0 through 5.0.19 are affected. After the upgrade, confirm the faspex-core container image is 5.0.19 at Fix Pack 1, the build IBM identifies as 1ce4b13. The Hacker News reports no public account yet of who is exploiting Faspex, or how widely. The Thursday clock still applies. An administrator the team did not grant is the cue to rotate Faspex accounts and to review transfers that left the server after that account changed.

OpenSSH is the one with public counts

CVE-2026-123158 is the OpenSSH authentication bypass on musl Linux that this desk reported when OpenSSH 10.6p2 shipped, and again when a honeypot recorded a root login in under nine hours. CISA added it on November 9 with the same November 12 due date.

Previdian has counted 22 exploitation attempts from 14 addresses since November 6. On November 7, Defused Cyber said the set of actors was still small. GreyNoise saw the first hit on its honeypots at 12:46 a.m. UTC that day, and later tied confirmed follow-on activity to six source addresses and 18 chains. That follow-on has included attempts to remain on the host. In at least one case, attackers installed a Python command-and-control agent known as TAC Agent. watchTowr has reported the same bug used for botnet enrollment and cryptocurrency mining.

Install OpenSSH 10.6p2, or the later package your distribution built for this flaw, and restart the SSH service. On Alpine, OpenWrt, and other musl systems, a password login that succeeds for an account configured to refuse passwords is a compromise. glibc systems sit outside this particular bug. Read the version string back from the host.

Before Thursday

If time is short, take GPUStack first. The fix has been out since July, and exploitation of 2.1.1 is already public. FreeSWITCH is next, then Faspex, then OpenSSH on every musl host that still accepts passwords. Federal agencies are on the directive. Every other operator has the same date, because the catalog is CISA’s statement that the bugs are in use.

CISA marked each entry for forensic triage and listed known ransomware use as unknown. A new version string, with no look behind it, leaves the week unfinished. Where a fix cannot be installed by Thursday, take the service off untrusted networks. CISA’s instruction, when a mitigation is unavailable, is to stop using the product.

This briefing relies on public reporting by The Hacker News, on CISA’s Known Exploited Vulnerabilities catalog, and on vendor advisories from GPUStack, SignalWire, IBM, and OpenSSH. It does not include exploit procedures or proof-of-concept detail.