U.S. cybersecurity officials are warning organizations to prioritize four vulnerabilities already being exploited in attacks, including flaws in OpenSSH, GPUStack, SignalWire FreeSWITCH and IBM Aspera Faspex. The Cybersecurity and Infrastructure Security Agency added the vulnerabilities to its Known Exploited Vulnerabilities catalog on Nov. 9, citing evidence of active exploitation.
The entries are CVE-2026-102895 in GPUStack, CVE-2026-116779 in SignalWire FreeSWITCH, CVE-2026-123158 in OpenBSD OpenSSH and CVE-2026-123218 in IBM Aspera Faspex. CISA’s alert identifies the GPUStack issue as an improper-authentication vulnerability, the FreeSWITCH issue as a code-injection flaw, the OpenSSH issue as an unexpected-status-code or return-value vulnerability, and the Faspex issue as an incorrect-authorization vulnerability.
The most fully documented of the four is the Faspex flaw. According to the National Vulnerability Database and IBM’s security bulletin, Aspera Faspex versions 5.0.0 through 5.0.19 allow an authorized user to craft a message that bypasses authorization and grants full administrative privileges. IBM rates the vulnerability 9.8 Critical under CVSS 3.1, with a vector indicating network reachability, low attack complexity and high impacts to confidentiality, integrity and availability.
IBM has released Faspex 5.0.19 PL1 as the fix and says administrators should verify that the faspex-core container image is at the corrected release. The vendor lists no workaround. NVD records the flaw as CWE-863, incorrect authorization, while noting that the NVD itself has not supplied a separate score; the 9.8 rating comes from IBM, the CVE’s assigning authority.
CISA did not publish technical indicators, affected-version ranges or threat-actor attribution in its alert, and the notice does not identify a public exploit campaign for any individual entry. That absence of detail does not reduce the priority: placement in the KEV catalog means CISA considers exploitation evidence sufficient to warrant urgent remediation, particularly for internet-facing systems and services that can provide administrative control or sensitive access.
Federal civilian agencies must follow the applicable requirements in CISA’s vulnerability-management directives, while the agency recommends that all organizations use the KEV catalog to drive risk-based patching. Defenders should identify exposed instances of the four products, apply vendor fixes where available, restrict unnecessary external access and review authentication, administrative and network logs for signs of compromise before and after remediation.
