---
title: CISA KEV adds four with a three-day deadline: SSHole in OpenSSH, GPUStack's loopback admin bypass, FreeSWITCH SIP command injection and IBM Aspera Faspex privilege escalation | ctxsec
url: https://ctxsec.com/items/cisa-kev-nov-9-gpustack-openssh-sshole-freeswitch-aspera-faspex
description: "CISA's Nov 9 catalog update (2026.11.09) adds four actively exploited flaws, all due Nov 12 for federal agencies and all flagged for CISA's forensic triage requirements under BOD 26-04. OpenSSH CVE-2026-123158 (SSHole), the Linux authentication bypass already seen hitting honeypots and Alpine hosts, is now formally in KEV; the fix is in OpenSSH 10.6p2 and distro packages. GPUStack CVE-2026-102895 lets unauthenticated requests be treated as the built-in administrator when GPUStack sits behind a same-host reverse proxy or receives a forged X-GPUStack-Real-IP header; the project says it was exploited against a v2.1.1 deployment where attackers added custom inference backends running reverse shells, and 2.2.0 fixes it. FreeSWITCH CVE-2026-116779, the SIP MESSAGE command injection covered Oct 29, is now listed too. IBM Aspera Faspex CVE-2026-123218 (CVSS 9.8 per IBM) lets an authenticated user craft a message that grants full administrative rights in Faspex 5.0.0 through 5.0.19; IBM's fix is 5.0.19 PL1 and it lists no workaround."
status: "official (CISA KEV catalog 2026.11.09, four entries added Nov 9, federal due date Nov 12, forensic triage required; ransomware use Unknown for all four); vendor fixes per GPUStack GHSA-gj9m-f8ph-pmhr, IBM bulletin 7295921, OpenSSH 10.6p2 and FreeSWITCH GHSA-mg63-h38w-8p9p"
published: 2026-11-09
---

> CISA's Nov 9 catalog update (2026.11.09) adds four actively exploited flaws, all due Nov 12 for federal agencies and all flagged for CISA's forensic triage requirements under BOD 26-04. OpenSSH CVE-2026-123158 (SSHole), the Linux authentication bypass already seen hitting honeypots and Alpine hosts, is now formally in KEV; the fix is in OpenSSH 10.6p2 and distro packages. GPUStack CVE-2026-102895 lets unauthenticated requests be treated as the built-in administrator when GPUStack sits behind a same-host reverse proxy or receives a forged X-GPUStack-Real-IP header; the project says it was exploited against a v2.1.1 deployment where attackers added custom inference backends running reverse shells, and 2.2.0 fixes it. FreeSWITCH CVE-2026-116779, the SIP MESSAGE command injection covered Oct 29, is now listed too. IBM Aspera Faspex CVE-2026-123218 (CVSS 9.8 per IBM) lets an authenticated user craft a message that grants full administrative rights in Faspex 5.0.0 through 5.0.19; IBM's fix is 5.0.19 PL1 and it lists no workaround.

[← Cybersecurity News](/news) · [markdown](/items/cisa-kev-nov-9-gpustack-openssh-sshole-freeswitch-aspera-faspex.md)

official (CISA KEV catalog 2026.11.09, four entries added Nov 9, federal due date Nov 12, forensic triage required; ransomware use Unknown for all four); vendor fixes per GPUStack GHSA-gj9m-f8ph-pmhr, IBM bulletin 7295921, OpenSSH 10.6p2 and FreeSWITCH GHSA-mg63-h38w-8p9p

2026-11-09

### CISA KEV adds four with a three-day deadline: SSHole in OpenSSH, GPUStack's loopback admin bypass, FreeSWITCH SIP command injection and IBM Aspera Faspex privilege escalation

- **OpenSSH CVE-2026-123158 (SSHole):** upgrade to OpenSSH 10.6p2 or your distribution's patched package (Alpine published its own advisory Nov 5). Prior items cover the exploitation evidence from watchTowr, Previdian and SANS ISC.
- **GPUStack CVE-2026-102895:** upgrade to `gpustack` 2.2.0. If you can't yet, set `force_auth_localhost=true`, strip client-supplied `X-GPUStack-Real-IP` at the edge, and keep the API off untrusted networks. After upgrading, review admin API keys (scope `*`) and inference backends created from YAML, since minted keys stay valid.
- **FreeSWITCH CVE-2026-116779:** upgrade per GHSA-mg63-h38w-8p9p; if SIP chat is unused, `enable-chat=false` on every profile closes the reported path.
- **IBM Aspera Faspex CVE-2026-123218:** upgrade to 5.0.19 PL1 and confirm the `faspex-core` image reads 5.0.19 (1ce4b13, Fix Pack 1). Exploitation needs an authenticated user, so external-user and guest accounts are the exposure.
- **Deadline:** Nov 12 is unusually short. CISA's KEV notes tell agencies to discontinue use if mitigations aren't available.

Sources: [CISA Known Exploited Vulnerabilities Catalog (four entries added Nov 9)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [CISA KEV JSON feed (catalogVersion 2026.11.09)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · [GPUStack advisory GHSA-gj9m-f8ph-pmhr: authentication bypass via trusted loopback source grants unauthenticated admin](https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr) · [IBM Security Bulletin: IBM Aspera Faspex authorization bypass (CVE-2026-123218)](https://www.ibm.com/support/pages/node/7295921) · [OpenSSH release notes (10.6p2, Nov 5)](https://www.openssh.org/releasenotes.html) · [FreeSWITCH advisory GHSA-mg63-h38w-8p9p](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)