CISA flags exploited flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex

The U.S. Cybersecurity and Infrastructure Security Agency added four exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Nov. 9, 2026, covering GPUStack, SignalWire FreeSWITCH, OpenSSH and IBM Aspera Faspex.

A KEV listing is different from a severity score. It means CISA has evidence that exploitation has occurred. In this batch, fixes or vendor-directed remediation paths are available for all four vulnerabilities.

CISA’s public alert did not name attackers, describe victim organizations or connect the flaws to a known ransomware campaign. The catalog lists known ransomware use as unknown for all four. The public record also does not show how many organizations were hit or whether the four entries are connected.

The risk is scattered across ownership lines

The affected products do not usually belong to the same administrator. GPUStack may sit with AI or data-science teams, FreeSWITCH with voice infrastructure, OpenSSH across Linux servers and container images, and Aspera Faspex with file-transfer or business application owners.

That spread can slow response in organizations with divided infrastructure ownership. Finding every instance may take longer than applying the fixed builds, especially where development platforms, communications systems or managed file-transfer tools are not in the same vulnerability queue.

GPUStack: trusted localhost became an admin path

The GPUStack advisory describes an authentication bypass in versions before 2.2.0. In affected deployments, a request considered to come from loopback could be promoted to the built-in administrator account when force_auth_localhost was set to its default value.

The advisory says that could happen through a same-host reverse proxy or a forged X-GPUStack-Real-IP header. The impact is broad: unauthenticated administrative access, user and model changes, creation of persistent admin API keys, exposure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

GPUStack’s advisory also says exploitation was observed in the wild against a 2.1.1 deployment, where attacker-created custom backends ran reverse shells. GPUStack 2.2.0 removes the loopback auto-admin path and hardens client-IP handling.

FreeSWITCH: a SIP message can reach command execution

SignalWire’s FreeSWITCH advisory covers versions up to and including 1.11.2. The issue involves inbound SIP MESSAGE handling, where the software can treat part of the message recipient as a chat protocol selector. If that selector reaches the api chat interface, a sender can cause FreeSWITCH API commands to run.

The advisory lists the impact as command execution with the privileges of the FreeSWITCH process, disclosure of configuration and credentials, and full call control. It also says exploitation of this path has been observed in the wild.

SignalWire says FreeSWITCH 1.11.3 and later close the route by default. For systems that cannot be upgraded immediately, the advisory points to disabling inbound SIP chat on profiles that do not need it by setting enable-chat=false. The advisory warns that message authentication alone does not close the path.

OpenSSH: narrow conditions, serious result

The OpenSSH entry is likely to draw the most attention because of the product name, but the affected configuration is narrow. OpenSSH’s 10.6p2 release notes say the release includes a security workaround for Linux systems using musl libc with PAM disabled. The OpenSSH team said it considers the root cause to be outside sshd, but exploitable through sshd and avoidable there.

Alpine Linux’s advisory gives the clearest example of the affected setup. It says a system can be affected when Alpine runs openssh-server without PAM or openssh-server-pam with UsePAM no, password authentication is enabled, an account has a password field of *, and another local account has a $5$ or $6$ password hash. Under those conditions, a very long password can authenticate successfully.

Alpine says affected systems should update OpenSSH and restart sshd, because upgrading the package alone does not replace the running daemon. Where immediate updating is not possible, Alpine says disabling password authentication and restarting sshd closes the hole.

IBM Aspera Faspex: authorization bypass in file transfer

IBM’s bulletin says IBM Aspera Faspex 5.0.0 through 5.0.19 is affected by an authorization bypass. IBM says an authenticated user could send a crafted message to bypass authorization and gain administrative privileges. IBM assigned the vulnerability a CVSS 3.1 base score of 9.8.

IBM recommends upgrading to IBM Aspera Faspex 5.0.19 PL1 on Linux and validating that the faspex-core container image reports version 5.0.19 with Fix Pack 1. IBM lists no workaround or mitigation in the bulletin.

What organizations can take from the federal deadline

BOD 26-04 applies to Federal Civilian Executive Branch agencies, not every private organization. CISA’s catalog entries give those agencies a Nov. 12, 2026, remediation due date and mark forensic triage as required for all four entries. CISA still encourages all organizations to prioritize KEV catalog vulnerabilities.

For nonfederal organizations, the practical response is to verify whether any of the four products are present, whether affected instances are reachable from untrusted networks, and whether the fixed version or vendor mitigation has been applied. Fix exposed systems first. Systems that were exposed before remediation should be reviewed for signs of earlier compromise, including attacker-created accounts, keys, credentials or other access that would survive an update.

Not sure what to read next?

I can suggest related Tech Help Canada articles based on the topic you’re reading now.

Suggest related reading →

Tech Help Canada Staff

Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us