Covered by 2 outlets — first reported by The Hacker News, Nov 10, 06:31 UTC
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
MentionsOpenSSH
Summary
CISA added four flaws affecting GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, citing evidence of active exploitation. One of them, CVE-2026-123218, is an incorrect authorization flaw in IBM Aspera Faspex rated CVSS 9.8. CISA urged federal agencies to patch the FreeSWITCH and Aspera Faspex flaws within three days.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, SecurityWeek. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog…
SecurityWeek
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.
Explained
The technology and terms in this story. Learn more
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-749Exposed Dangerous Method or Function
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-863Incorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.