CISA gives agencies until 12 November on OpenSSH and three more flaws

CISA gives agencies until 12 November on OpenSSH and three more flaws

10 November 2026: CISA has added four actively exploited flaws to its catalogue with a three-day deadline for US federal agencies: OpenSSH CVE-2026-123158, GPUStack CVE-2026-102895, IBM Aspera Faspex CVE-2026-123218 and FreeSWITCH CVE-2026-116779. All four have fixes, and the OpenSSH entry confirms that a bug first described as a narrow workaround is now in active use.

Not yet independently verified. We read CISA's catalogue data feed, because its web alert refused our request. IBM's bulletin does not describe the attacks that led to the listing, and the version field on the GPUStack advisory page is garbled, so the fixed version comes from its text. We will update this when it can be confirmed, and remove this note.

The OpenSSH bypass gets a number and attackers

We reported OpenSSH 10.6p2 when it shipped. The flaw affects Linux systems that use the musl C library with PAM disabled, which covers Alpine in many container images and embedded distributions. SecurityWeek reports that botnets and cryptocurrency miners are exploiting it under the name SSHole, and it names Buildroot, OpenWrt and Yocto alongside Alpine.

Alpine's conditions are specific: an account whose password field is "*", at least one other account with a hashed password, and a password of 257 to 1024 bytes. The fix is to update OpenSSH and restart sshd, or set PasswordAuthentication to no.

GPUStack trusted anything that looked local

In GPUStack before 2.2.0, a request judged to be from the loopback address became the built-in admin while force_auth_localhost is false, its default. A same-host reverse proxy or a forged X-GPUStack-Real-IP header was enough. The project reports exploitation against a 2.1.1 deployment, with attackers creating custom backends that ran reverse shells. The advisory appeared in July, so an unpatched GPU cluster has been exposed for months. If an upgrade has to wait, set force_auth_localhost to true and strip the header at the edge.

Aspera Faspex and FreeSWITCH

IBM rates its Aspera Faspex flaw at CVSS 9.8. Versions 5.0.0 to 5.0.19 allow a crafted message to obtain full administrative privileges, and the fix is 5.0.19 PL1, with no workaround offered. File transfer servers tend to face the internet and hold data that partners have just sent, which makes them a favoured target.

FreeSWITCH was covered in our earlier item on the SIP MESSAGE path to API commands. Version 1.11.3 fixes it, and setting enable-chat to false on profiles is the workaround.

What the deadline means outside government

The 12 November date binds federal civilian agencies only, but a three-day window shows how the agency rates the risk. Every entry is marked for forensic triage, so patching should come with a look for signs of earlier compromise: new admin API keys on GPUStack, unfamiliar custom backends, and unexpected accounts on Faspex.

We list Aspera among our IT product companies.

Company profile on TrustList: GPUStack

Sources

• CISA Known Exploited Vulnerabilities catalogue, data feed, 9 November 2026
• OpenSSH release notes, 10.6p2, 5 November 2026
• Alpine Linux: OpenSSH password authentication bypass, 5 November 2026
• SecurityWeek: Hackers exploiting SSHole authentication bypass in OpenSSH, 9 November 2026
• GPUStack advisory GHSA-gj9m-f8ph-pmhr, 31 July 2026
• IBM security bulletin for Aspera Faspex, 7 November 2026
• FreeSWITCH advisory GHSA-mg63-h38w-8p9p, 28 October 2026