Four Exploited Flaws Hit Their CISA KEV Deadline Today: OpenSSH ‘SSHole’, GPUStack, FreeSWITCH and Aspera Faspex
Three days ago CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal agencies until today, 12 November, to fix them. The four have little in common: a password bypass in OpenSSH on Alpine and other musl-based systems, an authentication bypass in the GPUStack AI cluster manager, a command path in the FreeSWITCH telephony server, and an authorization bypass in IBM Aspera Faspex file transfer. What they share is that attackers are already using them, and three days is CISA’s signal that the risk is immediate.
| OpenSSH | CVE-2026-123158 · 8.1 · fix 10.6p2 |
| GPUStack | CVE-2026-102895 · 9.8 · fix 2.2.0 (2.2.2 advised) |
| FreeSWITCH | CVE-2026-116779 · 9.8 · fix 1.11.3 |
| Aspera Faspex | CVE-2026-123218 · 9.8 · fix 5.0.19 PL1 |
What happened
[Confirmed] CISA added all four to the Known Exploited Vulnerabilities catalog on 9 November with a 12 November due date. Ransomware use is “Unknown” for each. Federal agencies must fix them today; for everyone else, a three-day clock means CISA sees real risk. (CISA KEV)
Who is affected and how each works
| Product | Affected | How it works | Fix / workaround |
|---|---|---|---|
| OpenSSH “SSHole” | sshd before 10.6p2 on musl libc without PAM (Alpine is the main case) | sshd misreads whether a string is a password hash; with some account setups any 256–1024-character password is accepted. [Confirmed] (Tenable) | 10.6p2, or PasswordAuthentication no. Rebuild container images. |
| GPUStack | Before 2.2.0 (advisory GHSA-gj9m-f8ph-pmhr, 31 Jul; the advisory itself lists no CVE) | With the default force_auth_localhost=false, loopback requests get admin; behind a same-host proxy every request looks local, and a spoofed X-GPUStack-Real-IP works. Attackers used it against a v2.1.1 deployment to create custom backends running reverse shells (reported by Javier Sixto). [Confirmed] (GPUStack advisory) | 2.2.2 (also fixes SAML flaw CVE-2026-102894); or force_auth_localhost=true, strip the header, block /auth/saml/callback |
| FreeSWITCH | 1.11.2 and earlier | A SIP MESSAGE that selects the “api” chat protocol reaches the FreeSWITCH API and runs commands. [Reported] (SecurityOnline) | 1.11.3; keep enable-chat-api-proto off, enable-chat=false, remove passwordless directory users |
| IBM Aspera Faspex | 5.0.0–5.0.19 | A crafted message bypasses authorization for full admin rights. IBM’s bulletin says nothing about exploitation; the KEV listing is the evidence. [Confirmed] (IBM) | 5.0.19 PL1 (faspex-core 1ce4b13, Fix Pack 1). No workaround. |
[Reported] SSHole was attacked fast: Previdian saw a first attempt under nine hours after disclosure and confirmed root on an Alpine honeypot. A self-hosting blog argues the root cause lies in musl rather than OpenSSH; for defenders the fix is the same. (Help Net Security) (botmonster) [Unknown] Who exploited GPUStack, FreeSWITCH and Faspex; no IOCs have been published for any of the four.
Exposure check
OS: Linux (Alpine and others) · Shell: sh/bash · Privileges: root for sshd -T · READ-ONLY
# OpenSSH: version, libc and the two settings that decide exposure
ssh -V
ldd "$(command -v sshd)" 2>/dev/null | grep -i musl
sshd -T 2>/dev/null | grep -Ei '^(passwordauthentication|usepam) '
# Recent password logins (Alpine logs to /var/log/messages by default)
grep -h 'Accepted password' /var/log/messages /var/log/auth.log 2>/dev/null | tail -n 50
# FreeSWITCH: version
fs_cli -x 'version'Exposed to SSHole if the version is below 10.6p2, ldd shows musl, passwordauthentication yes and usepam no. Any “Accepted password” for an account that shouldn’t use passwords is a lead. Commands not tested by MAG212 CYBER.
Contain and remediate (in order)
- Inventory musl-based hosts and images running sshd, GPUStack servers, FreeSWITCH boxes and Faspex instances; take any internet-facing ones off the internet if you can’t patch today.
- Patch to the fixed versions above, or apply the workarounds as a stop-gap.
- [MAG212 analysis] Triage anything exposed since disclosure: new SSH keys, cron jobs, miners, GPUStack API keys you didn’t create, unexpected FreeSWITCH dialplan or Lua changes, Faspex admin accounts.
- [MAG212 analysis] GPUStack exposes cloud-provider and worker secrets: rotate them on any instance that was reachable.
Verify recovery: fixed versions confirmed on every instance; PasswordAuthentication no where password login isn’t needed; no unexplained accounts or keys. Prevention [MAG212 analysis]: AI and GPU management servers are now on attackers’ lists; put them behind the same access controls as any admin console.
Why it matters
These products sit in places that are easy to forget: container images built once and never rebuilt, GPU servers stood up by research teams, VoIP boxes in a closet, and file-transfer servers that face partners. The SSHole flaw was attacked within hours of disclosure, and GPUStack exposes cloud-provider secrets as well as code execution. For organisations outside the federal government, a KEV deadline is still the clearest priority signal available.
The bottom line
Find every instance of the four products today, patch to the fixed versions or apply the workarounds, and because these flaws were exploited before many patches landed, check exposed systems for new keys, accounts and changed configurations rather than trusting the version number.
How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.
This story is part of MAG212 CYBER Daily, 12 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. By El Mostafa Ouchen.