{"id":4044,"date":"2026-11-10T07:06:55","date_gmt":"2026-11-10T07:06:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4044"},"modified":"2026-11-10T07:06:55","modified_gmt":"2026-11-10T07:06:55","slug":"cisa-warns-of-active-exploitation-of-openssh-gpustack-freeswitch-and-ibm-flaws","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4044","title":{"rendered":"CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 10, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVAsrcYxVs8sJe7IiSD6WkTC4yPv0eLfup7dwcsS0NLcAAgoY__wyC3UFCR90PL2ziKCEW-vMNIEQXES-8uAG-MxuXlyIDdQGeNREm8yFv3tbvsCVXXRyRGT4ORirvcVKP_uD62XHYy9w3x_P0o7XzkguJPwq_1vV2jPxxnZWbhAHHUJ3YJ6HbTlXb0shyphenhyphen\/s1700-nu-rw-lo-l85-e365\/openssh.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/11\/09\/cisa-adds-four-known-exploited-vulnerabilities-catalog\" target=\"_blank\">added<\/a> four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (<a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\">KEV<\/a>) catalog, citing evidence of active exploitation.<\/p>\n<p>The vulnerabilities are listed below &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7295921\" target=\"_blank\">CVE-2026-123218<\/a><\/strong> (CVSS score: 9.8) &#8211; An incorrect authorization vulnerability in IBM Aspera Faspex that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. (Fixed in November 2026)<\/li>\n<li><strong><a href=\"https:\/\/github.com\/signalwire\/freeswitch\/security\/advisories\/GHSA-mg63-h38w-8p9p\" target=\"_blank\">CVE-2026-116779<\/a><\/strong> (CVSS score: 9.8) &#8211; A code injection vulnerability in SignalWire FreeSwitch that could result in configuration and credential disclosure, arbitrary call control, and command execution. (Fixed in October 2026)<\/li>\n<li><strong><a href=\"https:\/\/www.openssh.org\/releasenotes.html#10.6p2\" target=\"_blank\">CVE-2026-123158<\/a><\/strong> aka SSHole (CVSS score: 8.1) &#8211; An unexpected status code or return value vulnerability in OpenBSD OpenSSH on Linux that could allow for authentication bypass. (Fixed in November 2026)<\/li>\n<li><strong><a href=\"https:\/\/github.com\/gpustack\/gpustack\/security\/advisories\/GHSA-gj9m-f8ph-pmhr\" target=\"_blank\">CVE-2026-102895<\/a><\/strong> (CVSS score: 9.8) &#8211; An improper authentication vulnerability in GPUStack that could allow improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST \/v2\/inference-backends\/from-yaml. (Fixed in July 2026)<\/li>\n<\/ul>\n<p>The addition of CVE-2026-123158 to the KEV catalog follows reports of exploitation attempts targeting the flaw since November 6, 2026. A total of 22 exploitation attempts have been recorded from 14 unique IP addresses so far, according to Previdian.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>In a <a href=\"https:\/\/x.com\/DefusedCyber\/status\/2118996075092521197\" target=\"_blank\">post shared<\/a> on X on November 7, 2026, Defused Cyber said it \u00abobserved a small amount of actors targeting SSHole\u00bb but stressed the exploitation activity is not widespread yet.<\/p>\n<p>According to <a href=\"https:\/\/sshole.events.greynoise.io\/\" target=\"_blank\">GreyNoise<\/a>, the first exploitation attempt against its honeypot network was observed on November 7, 2026, at 12:46 a.m. UTC. Confirmed post-exploitation activity has been detected from six source IP addresses, representing 18 distinct attack chains to date.<\/p>\n<p>These involve reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to gain persistent access.<\/p>\n<p>In at least one case, unknown threat actors have been observed deploying TAC Agent, a Python-based command-and-control (C2) agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself.<\/p>\n<p>Threat intelligence firm watchTowr <a href=\"https:\/\/x.com\/watchtowrcyber\/status\/2118636513739317525\" target=\"_blank\">said<\/a> it has also observed the OpenSSH flaw being weaponized in the wild for botnet and cryptocurrency miner activity.<\/p>\n<p>In an advisory for CVE-2026-102895 <a href=\"https:\/\/github.com\/gpustack\/gpustack\/security\/advisories\/GHSA-gj9m-f8ph-pmhr\" target=\"_blank\">published<\/a> on July 31, 2026, the maintainers of the GPUStack Python package credited Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for independently reporting the flaw, adding that \u00abactive in-the-wild exploitation\u00bb was reported by Ulex Innovative Systems&#8217; Javier Sixto.<\/p>\n<p>There are currently no public reports on how the other vulnerabilities are being exploited, who is behind them, and the scale of such efforts. Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 12, 2026.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 10, 2026Vulnerability \/ Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera&hellip;<\/p>\n","protected":false},"author":1,"featured_media":4045,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,62,65,11,4096,4095,4097,2085,148],"class_list":["post-4044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-cisa","tag-exploitation","tag-flaws","tag-freeswitch","tag-gpustack","tag-ibm","tag-openssh","tag-warns"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4044"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4044\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4045"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}