Attackers Exploit OpenSSH, FreeSWITCH, IBM Aspera, and GPUStack Flaws in the Wild as CISA Updates KEV Catalog
Do Son 
TL;DR
Threat actors are exploiting four critical and high-risk bugs in the wild across OpenSSH, FreeSWITCH, IBM Aspera Faspex, and GPUStack. Consequently, CISA added all four flaws to the CISA KEV Catalog on November 9, 2026. Federal agencies and network admins must patch their hosts by November 12, 2026, to block active attacks.
- Product: gpustack, signalwire freeswitch +2
- Vulnerabilities: 4 flaws (CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, CVE-2026-123218)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X--Real-IP header) grants unauthenticated admin
- Status: 3 exploited; patches available
- Exploit Intel (PatchThis): 4 of 4 confirmed
- Action: Update to 10.6p2 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-102895 | 9.8 | CWE-287 | — | Exploited |
| CVE-2026-116779 | 9.8 | CWE-77 | — | Exploited |
| CVE-2026-123218 | 9.8 | CWE-863 | — | Not exploited |
| CVE-2026-123158 | 8.1 | CWE-394 | 10.6p2 | Exploited |
Why It Matters
These four software tools run remote server logins, telecom switches, file transfers, and AI GPU clusters. Because attackers are exploiting all four bugs in the wild right now, unpatched hosts face immediate takeover risks. In addition, public exploit code is on GitHub for the OpenSSH bug (CVE-2026-123158). While exact install counts remain private, millions of Linux hosts, voice systems, and cloud servers run these tools globally.
How the Attack Works
OpenSSH and GPUStack Authentication Bypasses
First, CVE-2026-123158 (CVSS 8.1) hits OpenSSH when built with musl libc and no PAM support, such as on Alpine Linux. When an attacker sends a password of 256 to 1024 characters, musl returns an asterisk error string (CWE-394). That asterisk matches the stored field of passwordless accounts, letting attackers log in with no password. Second, CVE-2026-102895 (CVSS 9.8) lets attackers skip login checks in GPUStack (CWE-287). Intruders use a same-host reverse proxy or a fake X-GPUStack-Real-IP: 127.0.0.1 header to gain admin rights and run reverse shells.
FreeSWITCH and IBM Aspera Faspex Flaws
Third, CVE-2026-116779 (CVSS 9.8) is a code injection bug (CWE-78) in SignalWire FreeSWITCH. The SIP message handler splits the user field on a plus sign and lets callers run internal API chat commands. Thus, attackers can execute OS commands with daemon rights. Fourth, CVE-2026-123218 (CVSS 9.8) stems from weak access checks (CWE-863) in IBM Aspera Faspex. An authorized user can send a crafted message to bypass checks and take full admin control.
Affected Versions
The exploited bugs hit OpenSSH before 10.6p2 on musl Linux systems without PAM, such as Alpine Linux before 3.24.4. They also affect SignalWire FreeSWITCH before 1.11.3, GPUStack before 2.2.0, and IBM Aspera Faspex versions 5.0.0 through 5.0.19.
Patch and Mitigation Steps
To meet the CISA KEV Catalog deadline, admins must update OpenSSH to 10.6p2 and FreeSWITCH to 1.11.3 by November 12, 2026. Likewise, teams must update GPUStack to 2.2.0 and IBM Aspera Faspex past 5.0.19. If admins cannot patch now, they should turn off sshd password logins and strip X-GPUStack-Real-IP headers at their proxy.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
