{"id":4203,"date":"2026-11-12T07:02:26","date_gmt":"2026-11-12T15:02:26","guid":{"rendered":"https:\/\/cyber.mag212.com\/cisa-kev-deadline-openssh-sshole-gpustack-freeswitch-aspera-faspex-12-november\/"},"modified":"2026-11-12T07:02:26","modified_gmt":"2026-11-12T15:02:26","slug":"cisa-kev-deadline-openssh-sshole-gpustack-freeswitch-aspera-faspex-12-november","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cisa-kev-deadline-openssh-sshole-gpustack-freeswitch-aspera-faspex-12-november\/","title":{"rendered":"Quatre failles exploit\u00e9es ont atteint aujourd'hui leur date limite de v\u00e9rification CISA KEV\u00a0: OpenSSH \u2018\u00a0SSHole\u00a0\u2019, GPUStack, FreeSWITCH et Aspera Faspex"},"content":{"rendered":"\n

Three days ago CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal agencies until today, 12 November, to fix them. The four have little in common: a password bypass in OpenSSH on Alpine and other musl-based systems, an authentication bypass in the GPUStack AI cluster manager, a command path in the FreeSWITCH telephony server, and an authorization bypass in IBM Aspera Faspex file transfer. What they share is that attackers are already using them, and three days is CISA\u2019s signal that the risk is immediate.<\/p>\n\n\n\n

OpenSSH<\/strong><\/td>CVE-2026-123158 \u00b7 8.1 \u00b7 fix 10.6p2<\/td><\/tr>
GPUStack<\/strong><\/td>CVE-2026-102895 \u00b7 9.8 \u00b7 fix 2.2.0 (2.2.2 advised)<\/td><\/tr>
FreeSWITCH<\/strong><\/td>CVE-2026-116779 \u00b7 9.8 \u00b7 fix 1.11.3<\/td><\/tr>
Aspera Faspex<\/strong><\/td>CVE-2026-123218 \u00b7 9.8 \u00b7 fix 5.0.19 PL1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> CISA added all four to the Known Exploited Vulnerabilities catalog on 9 November with a 12 November due date<\/strong>. Ransomware use is “Unknown” for each. Federal agencies must fix them today; for everyone else, a three-day clock means CISA sees real risk. (CISA KEV<\/a>)<\/p>\n\n\n\n

\"Gantt
Figure 2 \u00b7 KEV clocks: four due today.<\/strong> Each bar runs from the date CISA added the flaw to the federal due date. Red bars end today. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected and how each works<\/h2>\n\n\n\n
Product<\/th>Affected<\/th>How it works<\/th>Fix \/ workaround<\/th><\/tr><\/thead>
OpenSSH “SSHole”<\/strong><\/td>sshd before 10.6p2 on musl libc without PAM<\/strong> (Alpine is the main case)<\/td>sshd misreads whether a string is a password hash; with some account setups any 256\u20131024-character password is accepted. [Confirmed]<\/strong> (Tenable<\/a>)<\/td>10.6p2, or PasswordAuthentication no<\/code>. Rebuild container images.<\/td><\/tr>
GPUStack<\/strong><\/td>Before 2.2.0 (advisory GHSA-gj9m-f8ph-pmhr, 31 Jul; the advisory itself lists no CVE)<\/td>With the default force_auth_localhost=false<\/code>, loopback requests get admin; behind a same-host proxy every request looks local, and a spoofed X-GPUStack-Real-IP<\/code> works. Attackers used it against a v2.1.1 deployment to create custom backends running reverse shells (reported by Javier Sixto). [Confirmed]<\/strong> (GPUStack advisory<\/a>)<\/td>2.2.2 (also fixes SAML flaw CVE-2026-102894); or force_auth_localhost=true<\/code>, strip the header, block \/auth\/saml\/callback<\/code><\/td><\/tr>
FreeSWITCH<\/strong><\/td>1.11.2 and earlier<\/td>A SIP MESSAGE that selects the “api” chat protocol reaches the FreeSWITCH API and runs commands. [Reported]<\/strong> (SecurityOnline<\/a>)<\/td>1.11.3; keep enable-chat-api-proto<\/code> off, enable-chat=false<\/code>, remove passwordless directory users<\/td><\/tr>
IBM Aspera Faspex<\/strong><\/td>5.0.0\u20135.0.19<\/td>A crafted message bypasses authorization for full admin rights. IBM’s bulletin says nothing about exploitation; the KEV listing is the evidence. [Confirmed]<\/strong> (IBM<\/a>)<\/td>5.0.19 PL1 (faspex-core 1ce4b13, Fix Pack 1). No workaround.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

[Reported]<\/strong> SSHole was attacked fast: Previdian saw a first attempt under nine hours after disclosure and confirmed root on an Alpine honeypot. A self-hosting blog argues the root cause lies in musl rather than OpenSSH; for defenders the fix is the same. (Help Net Security<\/a>) (botmonster<\/a>) [Unknown]<\/strong> Who exploited GPUStack, FreeSWITCH and Faspex; no IOCs have been published for any of the four.<\/p>\n\n\n\n

Exposure check<\/h3>\n\n\n\n

OS: Linux (Alpine and others) \u00b7 Shell: sh\/bash \u00b7 Privileges: root for sshd -T \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

# OpenSSH: version, libc and the two settings that decide exposure\nssh -V\nldd "$(command -v sshd)" 2>\/dev\/null | grep -i musl\nsshd -T 2>\/dev\/null | grep -Ei '^(passwordauthentication|usepam) '\n# Recent password logins (Alpine logs to \/var\/log\/messages by default)\ngrep -h 'Accepted password' \/var\/log\/messages \/var\/log\/auth.log 2>\/dev\/null | tail -n 50\n# FreeSWITCH: version\nfs_cli -x 'version'<\/code><\/pre>\n\n\n\n
Exposed to SSHole if the version is below 10.6p2, ldd<\/code> shows musl, passwordauthentication yes<\/code> and usepam no<\/code>. Any “Accepted password” for an account that shouldn’t use passwords is a lead. Commands not tested by MAG212 CYBER.<\/strong><\/p>\n\n\n\n
Contain and remediate (in order)<\/h2>\n\n\n\n
    \n
  1. Inventory<\/strong> musl-based hosts and images running sshd, GPUStack servers, FreeSWITCH boxes and Faspex instances; take any internet-facing ones off the internet if you can’t patch today.<\/li>\n\n\n
  2. Patch<\/strong> to the fixed versions above, or apply the workarounds as a stop-gap.<\/li>\n\n\n
  3. [MAG212 analysis]<\/strong> Triage<\/strong> anything exposed since disclosure: new SSH keys, cron jobs, miners, GPUStack API keys you didn’t create, unexpected FreeSWITCH dialplan or Lua changes, Faspex admin accounts.<\/li>\n\n\n
  4. [MAG212 analysis]<\/strong> GPUStack exposes cloud-provider and worker secrets: rotate them on any instance that was reachable.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> fixed versions confirmed on every instance; PasswordAuthentication no<\/code> where password login isn’t needed; no unexplained accounts or keys. Prevention<\/strong> [MAG212 analysis]<\/strong>: AI and GPU management servers are now on attackers’ lists; put them behind the same access controls as any admin console.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    These products sit in places that are easy to forget: container images built once and never rebuilt, GPU servers stood up by research teams, VoIP boxes in a closet, and file-transfer servers that face partners. The SSHole flaw was attacked within hours of disclosure, and GPUStack exposes cloud-provider secrets as well as code execution. For organisations outside the federal government, a KEV deadline is still the clearest priority signal available.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    Find every instance of the four products today, patch to the fixed versions or apply the workarounds, and because these flaws were exploited before many patches landed, check exposed systems for new keys, accounts and changed configurations rather than trusting the version number.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 12 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    La CISA a donn\u00e9 aux agences f\u00e9d\u00e9rales jusqu'au 12 novembre pour corriger quatre vuln\u00e9rabilit\u00e9s activement exploit\u00e9es\u00a0: OpenSSH sur musl\/Alpine, le gestionnaire de clusters d'IA GPUStack, FreeSWITCH et IBM Aspera Faspex. Ce document d\u00e9taille les personnes concern\u00e9es, le fonctionnement de chaque faille, les versions corrig\u00e9es, les solutions de contournement et une \u00e9valuation de l'exposition.<\/p>","protected":false},"author":1,"featured_media":4187,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,15,14],"tags":[62,288,289,324,210,30],"class_list":["post-4203","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-threat-intelligence","category-vulnerabilities","tag-cisa-kev","tag-freeswitch","tag-gpustack","tag-ibm-aspera","tag-openssh","tag-zero-day-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4203"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4203\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4187"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}