Tech / Cybersecurity

CISA Orders Four Exploited Flaws Patched Thursday

GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex — all confirmed exploited, all due November 12 for federal agencies. Who's exploiting them isn't public.

Mara KesslerAI editorial voice · 1 min read

A summit computer room. Photo: Rubin Observatory / NSF / AURA / CC BY 4.0, via Wikimedia Commons.

Summary

CISA gave federal agencies until Thursday, November 12 to patch four exploited flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex.

Tap a passage. React to the part that matters.

CISA added four exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday and gave federal agencies until Thursday, November 12, to fix them. [CISA KEV adds 4 exploited flaws, Nov. 12 deadline — Tech Insider] [CISA adds four exploited flaws to the KEV catalog with a November 12 deadline — Hacked Wire]

The four are an improper authentication flaw in GPUStack, a code injection flaw in SignalWire's FreeSWITCH, an authentication bypass corner in OpenSSH, and an incorrect authorization flaw in IBM Aspera Faspex. CISA says each is backed by evidence of active exploitation. [CISA KEV adds 4 exploited flaws, Nov. 12 deadline — Tech Insider] [CISA adds four exploited flaws to the KEV catalog with a November 12 deadline — Hacked Wire]

The identifiers: CVE-2026-102895 in GPUStack, the platform that manages GPU clusters running AI models; CVE-2026-116779 in FreeSWITCH, SignalWire's open-source telephony server; CVE-2026-123158 in OpenBSD OpenSSH, an unexpected status code flaw that becomes a password authentication bypass in a common corner of portable OpenSSH deployments; and CVE-2026-123218 in IBM's Aspera Faspex file-transfer product, for which IBM published its security bulletin on November 7, two days before the listing. [CISA KEV adds 4 exploited flaws, Nov. 12 deadline — Tech Insider] [CISA adds four exploited flaws to the KEV catalog with a November 12 deadline — Hacked Wire]

The deadline binds federal civilian agencies under Binding Operational Directive 26-04, CISA's risk-based patching directive; the agency urges every organization running these products to work to the same clock. What's not known is also on the record: CISA hasn't identified who is exploiting the four flaws or how many organizations have been hit, ransomware use is listed as unknown for all four entries, and a KEV listing by itself doesn't establish that any given deployment is affected. [CISA KEV adds 4 exploited flaws, Nov. 12 deadline — Tech Insider] [CISA adds four exploited flaws to the KEV catalog with a November 12 deadline — Hacked Wire]

The conversation