The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding the exploitation of vulnerabilities in various software, adding them to its Known Exploited Vulnerabilities (KEV) catalog. These concerns involve software such as GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex, indicating ongoing exploitation attempts.
Details of the Vulnerabilities
Among the vulnerabilities, CVE-2026-123218, with a CVSS score of 9.8, affects IBM Aspera Faspex. It allows authenticated users to bypass authorization, potentially escalating privileges. This flaw was addressed in November 2026. Similarly, a vulnerability in SignalWire FreeSwitch, identified as CVE-2026-116779, also scores 9.8 on the CVSS scale. It allows code injection that could lead to the exposure of configuration and credentials, along with other serious impacts, and was patched in October 2026.
Another significant flaw, known as CVE-2026-123158 or ‘SSHole’, affects OpenBSD OpenSSH on Linux. It could enable authentication bypass and was patched by November 2026. This vulnerability, scoring 8.1 on the CVSS scale, has seen exploitation attempts since early November. Lastly, CVE-2026-102895 impacts GPUStack, with a CVSS score of 9.8. It allows unauthorized access and administrative actions, with a fix implemented in July 2026.
Recent Exploitation Findings
Since November 6, 2026, reports of exploitation attempts on the SSHole vulnerability have surfaced, with 22 attempts recorded from 14 unique IP addresses. This was highlighted by cybersecurity firm Previdian. On November 7, 2026, Defused Cyber noted limited actor activity targeting this flaw but emphasized that widespread exploitation has not yet occurred.
GreyNoise documented the first exploitation attempt against its honeypot network on November 7, capturing activities from six distinct IP addresses across 18 attack chains. These attacks involve reconnaissance and attempts to modify system files to gain persistent access.
Threat Actors and Ongoing Risks
One threat actor, identified as GT10, has deployed the TAC Agent, a Python-based tool with capabilities for executing commands, system reconnaissance, and file transfers. Concurrently, watchTowr observed the use of the OpenSSH vulnerability for botnet activities and cryptocurrency mining.
For GPUStack, the reported vulnerability was independently identified by several researchers, with active exploitation noted in advisory reports. However, detailed information on the exploitation of other vulnerabilities remains scarce. CISA advises Federal Civilian Executive Branch (FCEB) agencies to patch these vulnerabilities by November 12, 2026, to mitigate potential risks.
These developments underscore the critical need for organizations to remain vigilant and ensure timely updates to their software systems to fend off potential security breaches.
