Follow us on Google News
The United States Cybersecurity and Infrastructure Security Agency has added four critical vulnerabilities affecting widely used software systems to its Known Exploited Vulnerabilities catalog following confirmed evidence of active exploitation by cyber attackers. The flaws affect GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex, carrying Common Vulnerability Scoring System ratings ranging from 8.1 to 9.8. Federal civilian executive branch agencies have been directed to apply the necessary security updates by November 12, 2026, to shield government networks from potential breaches and unauthorized intrusions.
Active Exploitation of OpenSSH Flaw
Among the four listed vulnerabilities, the most prominent concern surrounds a critical flaw in OpenBSD OpenSSH running on Linux environments, designated as CVE-2026-123158 with a severity rating of 8.1. Dubbed SSHole, the weakness allows threat actors to bypass standard authentication controls and secure unauthorized entry into targeted systems. Under normal operations, Secure Shell protocols provide encrypted and verified communication pathways between servers and remote computers, making an authentication bypass a severe operational hazard for enterprise infrastructure.
Telemetry recorded by cybersecurity monitoring firms indicates that exploit activity against the OpenSSH flaw commenced on November 6, with Previdian tracking 22 attack attempts originating from 14 distinct internet protocol addresses. On November 7, Defused Cyber observed targeted probing, while monitoring network GreyNoise detected initial exploit attempts on its honeypot infrastructure at 12:46 AM UTC on the same day. GreyNoise confirmed 18 sequential attack patterns linked to six source addresses, involving reconnaissance, attempts to reach cloud metadata services, reads of password hashes and root SSH keys, and modifications to authorized_keys files to retain persistent server access.
In at least one instance, an unidentified threat actor tracked as GT10 deployed a Python-based command-and-control agent known as TAC Agent, which executes commands, surveys files and directories, transfers data, and updates itself remotely. Additionally, cybersecurity firm watchTowr confirmed that the vulnerability has been leveraged to recruit compromised systems into botnet arrays and engage in cryptocurrency mining.
Critical Authentication and Code Execution Risks
A second vulnerability, tracked as CVE-2026-102895 and rated 9.8, impacts GPUStack due to improper authentication controls. Exploitation occurs through an inference backend interface, enabling attackers to gain full administrative privileges without valid credentials. This exposure permits modification of users and artificial intelligence models, generation of permanent administrator API keys, theft of worker and cloud provider secrets, and arbitrary command execution. GPUStack maintainers patched the flaw in July 2026 following discoveries credited to researchers Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang, with in-the-wild exploitation flagged by Javier Sixto of Ulex Innovative Systems.
Severe Flaws in Telephony and File Transfer Systems
The remaining two flaws also carry maximum-tier CVSS scores of 9.8. SignalWire FreeSWITCH is affected by CVE-2026-116779, a code injection defect patched in October 2026 that allows adversaries to seize call controls, extract credentials, and execute arbitrary commands. Meanwhile, IBM Aspera Faspex is affected by CVE-2026-123218, an authorization issue resolved in November 2026 where an authenticated user can craft special messages to bypass restrictions and escalate privileges. While comprehensive details regarding the exact scale and perpetrators targeting FreeSWITCH and Aspera Faspex remain limited, cybersecurity authorities emphasize that prompt patching and continuous server monitoring remain vital to mitigating these emerging threats.
