CISA Adds Four Known Exploited Vulnerabilities to Catalog
MentionsOpenSSH
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization…
Summary from CISA Advisories.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-287Improper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-290Authentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-346Origin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
- CWE-394Unexpected Status Code or Return Value
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak
Podcast7 minSANS Internet Storm Center StormCast2d agoVulnerabilitiesAIIdentityCVE-2026-109469CVE-2026-123158+1