CISA Adds Four Exploited Flaws to the KEV Catalog With a November 12 Deadline

The Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 9, 2026, each backed by evidence of active exploitation, and set a remediation deadline of November 12 for federal civilian agencies. The additions cover an AI cluster management platform, a widely deployed telephony server, the OpenSSH remote access daemon, and an enterprise file transfer product.

CISA announced the batch in an alert published the same day. The agency said the four flaws were added “based on evidence of active exploitation” and warned that “these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.”

The four additions

CVE-2026-102895, GPUStack. An improper authentication flaw in GPUStack, a platform for managing GPU clusters that run AI models. Versions before 2.2.0 are affected, and the maintainers list 2.2.0 as the fixed release. Reporting based on the maintainers’ advisory describes the failure as a trust problem at the network edge: in deployments fronted by a reverse proxy, a request that appears to come from a trusted local address can be treated as an administrator session, opening user and model management, administrative API keys, and stored worker and cloud provider secrets to an unauthenticated caller. The flaw carries a CVSS v3.1 score of 9.8.

CVE-2026-116779, SignalWire FreeSWITCH. A code injection flaw in FreeSWITCH, the open source telephony platform maintained by SignalWire. Versions through 1.11.2 are affected and 1.11.3 is the fixed release, according to the SignalWire advisory. Successful exploitation can expose configuration files and credentials, allow control of calls, and run commands on the server. The flaw also carries a CVSS v3.1 score of 9.8.

CVE-2026-123158, OpenBSD OpenSSH. An unexpected status code or return value flaw that becomes a password authentication bypass in a specific and common corner of Linux deployments: portable OpenSSH running on distributions that use the musl C library with PAM disabled, a configuration typical of Alpine Linux based container images and small systems built with OpenWrt, Buildroot, or Yocto. Fixed packages are available from the distributions, and OpenSSH 10.6p2 is the upstream fixed release. The flaw carries a CVSS v3.1 score of 8.1. Alpine Linux notes that systems using its openssh-server-pam package with PAM enabled, and containers that do not run an SSH daemon at all, are outside the affected path.

CVE-2026-123218, IBM Aspera Faspex. An incorrect authorization flaw in IBM’s high speed file transfer product. IBM lists Faspex versions 5.0.0 through 5.0.19 as affected and recommends the 5.0.19 PL1 fix. An authenticated user who crafts a specific message can bypass authorization checks and escalate privileges. The flaw carries a CVSS v3.1 score of 9.8.

Photo: DHSgov, Public domain, via Wikimedia Commons

What the deadline requires

The November 12 due date binds Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04, CISA’s risk based patching directive. For all four entries the catalog also flags forensic triage as required: before or alongside patching, agencies must check whether the system was already compromised. CISA records ransomware campaign use as unknown for each of the four entries.

CISA’s alert notes that BOD 26-04 requires agencies to prioritize KEV listed flaws on publicly exposed assets that grant total control of the asset after exploitation, and it encourages every organization, not only federal agencies, to run the same risk based prioritization. A KEV listing is not a measure of how many victims exist. CISA has not identified who is exploiting these four flaws or how many organizations have been hit, and the catalog entry alone does not establish that any given deployment is affected. That check, matching the affected versions above against your own inventory, is the first task.

What to do first

For defenders outside the federal deadline, the practical order follows the exposure. Internet facing FreeSWITCH servers and Faspex instances should be patched or taken behind access controls first, because both flaws hand an attacker server side control. GPUStack administrators should upgrade to 2.2.0 and review administrative accounts and API keys created before the upgrade. Anyone running SSH servers on Alpine or other musl based images should confirm which OpenSSH package and PAM configuration the image ships, apply the distribution’s fixed package, and restart the daemon, since a patched library does not protect a still running vulnerable process.

No corrections have been published for this article.