CISA adds exploited OpenSSH, GPUStack, FreeSWITCH and IBM Aspera Faspex flaws to KEV catalog
Confirmed exploitation moves these four from watch-list to remediation priority for any organisation running OpenSSH, file-transfer tooling, telephony software or AI serving infrastructure. Security teams should inventory GPUStack deployments, which are often stood up outside standard change control, and patch in KEV order regardless of whether the federal directive applies to them. Regulated firms should expect auditors to treat KEV status as the benchmark for timely remediation.
What Happened
On 9 November CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. They are GPUStack CVE-2026-102895 (improper authentication), SignalWire FreeSWITCH CVE-2026-116779 (code injection), OpenBSD OpenSSH CVE-2026-123158 (unexpected status code or return value) and IBM Aspera Faspex CVE-2026-123218 (incorrect authorization). BOD 26-04 applies only to federal civilian agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and prioritise KEV remediation.
Why It Matters
Confirmed exploitation moves these four from watch-list to remediation priority for any organisation running OpenSSH, file-transfer tooling, telephony software or AI serving infrastructure. Security teams should inventory GPUStack deployments, which are often stood up outside standard change control, and patch in KEV order regardless of whether the federal directive applies to them. Regulated firms should expect auditors to treat KEV status as the benchmark for timely remediation.
Sources
- CISA (opens in a new tab): CISA Adds Four Known Exploited Vulnerabilities to Catalog (2026-11-09)
More From This Briefing
- Anthropic releases Claude Fable 5.2 and Mythos 5.2, cutting prices ahead of its planned IPO
- OpenAI closes first $11bn of new round at $1.25tn valuation, short of its original target
- Anthropic system card: Mythos 5.2 and Fable 5.2 often voice suspicion they are being evaluated
- Bermuda Monetary Authority, Ascot and Docosoft join Future Claims Bermuda forum on claims technology
More on Defense
- Nvidia opens probe into CEO Jensen Huang after he confirms relationship with woman accused of spying for China (9 November 2026)
- Attackers exploit OpenSSH 'SSHole' flaw within hours of disclosure, gaining root on a honeypot (9 November 2026)
- Pentagon CTO says US will publish the laws and rules that apply to domestic AI labs within weeks (8 November 2026)
- Researchers show two patched Barracuda Email Security Gateway flaws chain to unauthenticated root access (8 November 2026)
Key Terms
- AI audit: An AI audit is an independent examination of an AI system's controls, records and outcomes against defined criteria such as a law, a...
- Known Exploited Vulnerabilities (KEV) catalog: The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of...
- CVE: A CVE (Common Vulnerabilities and Exposures) identifier is a unique public reference, such as CVE-2026-12345, assigned to a specific...
- AI benchmark: An AI benchmark is a standard set of tasks used to measure and compare model performance, for example on coding, mathematics, reasoning or...
- GPU (AI accelerator): A GPU, or graphics processing unit, is a processor designed for massively parallel computation. GPUs and similar AI accelerators are the...
Filed under Defense and National Security, Infrastructure, Cybersecurity and AI Threats, Data Centres and Compute, Government and National Security, CISA, IBM.
This story is part of the Laurenceo Intelligence briefing for 10 November 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.