CISA adds GPUStack, FreeSwitch, OpenSSH and Aspera Faspex flaws to exploited list

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws it has evidence attackers are using. The agency listed an improper authentication flaw in GPUStack, a code injection flaw in SignalWire FreeSwitch, an unexpected status code flaw in OpenBSD OpenSSH, and an incorrect authorization flaw in IBM Aspera Faspex. ^[1]

The OpenSSH entry is CVE-2026-123158, known as sshole. Horizon3.ai describes it as a login bypass in the OpenSSH server affecting Alpine Linux in its default setup and other Linux systems built on musl libc that do not use PAM. The CISA listing carries a federal due date of 2026-11-12, and the flaw has a CVSS score of 8.1. ^[1][2]

The SANS Internet Storm Center says its SSH honeypots have recorded an increase in attempts to exploit the sshole flaw since it emerged. It notes its data is limited because the honeypots keep only the first 255 characters of SSH passwords. ^[3]

An OpenBSD advisory dated November 5 lists OpenSSH as affected. CISA says flaws of this kind are a frequent attack vector and pose significant risks to the federal enterprise. ^[4][1]