CISA lists four server-side flaws as actively exploited
CISA has added four vulnerabilities in GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation, according to The Hacker News. The entries affect server software and internet-facing services, and fixes are listed for all four flaws.
The IBM Aspera Faspex flaw, CVE-2026-123218, allows an authenticated user to craft a message that bypasses authorization and causes privilege escalation, the report said. CVE-2026-116779 in SignalWire FreeSWITCH can expose configuration data and credentials, control calls and execute commands through code injection. Both flaws are listed as fixed in November and October 2026 respectively.
The OpenSSH vulnerability CVE-2026-123158, also called SSHole, can bypass authentication because of an unexpected status code or return value, according to the report. Previdian recorded 22 exploitation attempts from 14 IP addresses since November 6, 2026. Defused Cyber described the activity as limited, while GreyNoise detected reconnaissance, cloud-metadata queries, attempts to read password hashes and root SSH keys, and changes to authorized_keys files for persistent access.
GreyNoise also detected post-exploitation activity from six source IP addresses across 18 attack chains, the report said. In at least one case, attackers deployed TAC Agent, a Python-based command-and-control agent that can execute shell commands, gather system information, enumerate directories, transfer files and update itself. watchTowr separately observed the OpenSSH flaw being used for botnet and cryptocurrency-mining activity.
The fourth entry, CVE-2026-102895 in GPUStack, allows unauthenticated administrative access, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution, according to the report. The flaw is listed as fixed in July 2026. The report said there are no public reports describing exploitation of the other three vulnerabilities, identifying the attackers or measuring the scale of those efforts. Federal Civilian Executive Branch agencies are recommended to apply the fixes by November 12, 2026.