Science & Tech · Cybersecurity · 2 hrs ago
CISA Warns Four Software Flaws Are Being Actively Exploited
CISA added four software flaws to its list of vulnerabilities under active exploitation on Monday.
The flaws affect GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH on Linux, and IBM Aspera Faspex.
The OpenSSH flaw can let attackers bypass authentication, while the other bugs could expose credentials or allow unauthorized access and code execution.
The OpenSSH vulnerability, known as SSHole, has drawn recorded attack attempts since November 6, though one cybersecurity firm said activity was not widespread.
Attackers have used the flaw to probe systems and seek lasting access, and one case involved a command-and-control tool.
The flaws have been fixed, with fixes released between July and November 2026.
Federal civilian agencies are advised to install the fixes by November 12, 2026.
CISA added four software vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
The flaws affect IBM Aspera Faspex, SignalWire FreeSWITCH, OpenBSD OpenSSH and GPUStack.
Reported impacts include authentication or authorization bypass, code execution and exposure of credentials or secrets.
Researchers reported exploitation of the OpenSSH flaw, including activity linked to botnet and cryptocurrency-mining operations.
CISA recommended that Federal Civilian Executive Branch agencies apply fixes by November 12, 2026.
- Who
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA).
- What
- CISA added four software flaws to its Known Exploited Vulnerabilities catalog, citing active exploitation.
- When
- Monday; the article was published November 10, 2026.
- Where
- The vulnerabilities affect IBM Aspera Faspex, SignalWire FreeSWITCH, OpenBSD OpenSSH and GPUStack.
- Why
- CISA cited evidence that the flaws were being actively exploited.
This story does not have two clearly opposing sides.
GPUStack package maintainers published an advisory for CVE-2026-102895.
Reports of exploitation attempts targeting the OpenSSH flaw began.
Defused Cyber reported seeing some actors targeting SSHole, and GreyNoise recorded its first honeypot exploitation attempt.
CISA added the four vulnerabilities to its Known Exploited Vulnerabilities catalog.
CISA’s recommended deadline for Federal Civilian Executive Branch agencies to apply fixes.
- Vulnerabilities added
- 4
- Affected products
- GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex
- OpenSSH flaw
- CVE-2026-123158, also known as SSHole
- Reported exploitation attempts
- 22 attempts from 14 unique IP addresses, according to Previdian
- Agency fix deadline
- November 12, 2026
What people are saying
observed a small amount of actors targeting SSHole
active in-the-wild exploitation
Posts on X
🚨 As expected, watchTowr Intel is observing exploitation of the OpenSSH Authentication Bypass “SSHole” (CVE-2026-123158). For now, it’s botnets and crypto miners. We’re interested in what happens next.
🚨During the past 24 hours, we have observed a small amount of actors targetting SSHole (CVE-2026-123158) Exploitation is not widespread yet, but is showing an early accelerating trend. Track exploit intelligence 👉https://t.co/FMlpPAiZfm