CISA Warns of Exploited OpenSSH, GPUStack, FreeSwitch, and IBM Flaws

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added four security vulnerabilities affecting IBM Aspera Faspex, SignalWire FreeSwitch, OpenBSD OpenSSH, and GPUStack to its Known Exploited Vulnerabilities catalog. Citing evidence of active exploitation in the wild, the agency has instructed Federal Civilian Executive Branch agencies to remediate the flaws by 12 November 2026. The catalogued vulnerabilities carry Common Vulnerability Scoring System scores ranging from 8.1 to 9.8, presenting severe operational risks including authentication bypass, command injection, and complete administrative compromise.

Key Facts

How Are Threat Actors Exploiting the OpenSSH Flaw?

Threat actors are actively attempting to exploit the OpenSSH vulnerability, designated CVE-2026-123158 or SSHole, to bypass authentication on Linux systems. Honeypot sensors and telemetry have detected reconnaissance, queries to cloud metadata services, attempts to harvest credentials, and the deployment of botnets, cryptocurrency miners, and a custom Python-based command-and-control tool.

According to Previdian, 22 exploitation attempts originating from 14 unique IP addresses have been recorded since 6 November 2026. Defused Cyber noted on 7 November 2026 that a small group of actors was targeting the flaw, emphasising that widespread activity had not yet materialised. Telemetry from GreyNoise recorded the first attack against its honeypot network on 7 November 2026 at 12:46 a.m. UTC, tracking post-exploitation activity across six source IP addresses and 18 distinct attack chains. These intrusions involved attempts to inspect root SSH keys, read password hashes, query cloud metadata endpoints, and modify the authorized_keys configuration file for persistence. Furthermore, security firm watchTowr observed weaponisation of the flaw for cryptocurrency mining and botnets, whilst other operators deployed TAC Agent, a Python-based command-and-control tool capable of executing shell commands, directory enumeration, and file transfer.

Exploitation of CVE-2026-123158 has targeted Linux implementations of OpenBSD OpenSSH to establish persistence and deploy secondary payloads.

What Risks Do the Remaining Three Vulnerabilities Pose?

The remaining three flaws carry maximum-severity CVSS scores of 9.8 and enable critical impacts including administrative takeover and remote code execution. GPUStack allows unauthenticated administrative access, SignalWire FreeSwitch permits arbitrary call control and command injection, and IBM Aspera Faspex enables authenticated users to bypass authorisation mechanisms to escalate system privileges.

In GPUStack, CVE-2026-102895 represents an improper authentication flaw that permits unauthenticated administrative access. Maintainers revealed that attackers can create persistent administrator API keys, modify users and models, extract cloud-provider and worker secrets, and achieve arbitrary code execution via POST /v2/inference-backends/from-yaml. SignalWire FreeSwitch flaw CVE-2026-116779 allows code injection resulting in credential disclosure, arbitrary call control, and command execution. IBM Aspera Faspex vulnerability CVE-2026-123218 enables an authenticated user to craft specific messages to bypass authorisation checks and escalate privileges. Aside from GPUStack and OpenSSH, public intelligence regarding threat actor identities, specific campaigns, or the broader scale of exploitation for the remaining flaws has not been released.

Three of the four catalogued vulnerabilities permit severe privilege escalation, secret disclosure, or arbitrary code execution with a CVSS rating of 9.8.

What Should You Do?

• Apply the official vendor updates released for IBM Aspera Faspex (issued November 2026), SignalWire FreeSwitch (issued October 2026), OpenBSD OpenSSH (issued November 2026), and GPUStack (issued July 2026).
• Ensure compliance with CISA remediation requirements by 12 November 2026 where applicable.
• Malaysian organisations identifying suspicious activity or system compromise may report incidents directly to Cyber999 via the Malaysia Computer Emergency Response Team (MyCERT).

Common Questions

What is the SSHole vulnerability?

SSHole is the tracking moniker for CVE-2026-123158, an unexpected return value vulnerability in OpenBSD OpenSSH on Linux with a CVSS score of 8.1. The flaw allows attackers to bypass authentication and was officially resolved by vendor updates in November 2026.

Who discovered and reported the GPUStack flaw?

The GPUStack vulnerability, CVE-2026-102895, was independently reported by researchers Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang. Maintainers also credited Javier Sixto of Ulex Innovative Systems for identifying and reporting active in-the-wild exploitation of the issue in July 2026.

What malicious software has been deployed using these flaws?

Intruders targeting OpenSSH have deployed TAC Agent, a Python-based command-and-control tool capable of directory enumeration, command execution, and file transfers. Threat intelligence firm watchTowr has also detected threat actors weaponising the vulnerability to deliver botnet malware and illicit cryptocurrency miners.

Sources and Methodology

This report was compiled from reporting published by The Hacker News on 10 November 2026. This dispatch is based exclusively on the provided source text and does not reference unverified external documents or vendor advisories.