CISA KEV additions include GPUStack, FreeSWITCH, OpenSSH, and IBM Aspera Faspex flaws

What happened

On November 9, 2026, CISA added four vulnerabilities to its KEV catalog following evidence of active exploitation.

In GPUStack, attackers can spoof a loopback request to gain unauthenticated administrative access, allowing them to modify users, steal cloud provider secrets, and execute code via POST /v2/inference-backends/from-yaml. Exploitation has been seen against version 2.1.1.

SignalWire FreeSWITCH contains a flaw where processing an inbound SIP MESSAGE allows a peer to run API commands, including operating-system command sinks, with daemon privileges.

OpenSSH (dubbed "SSRole") is being targeted on Linux systems using musl libc without PAM. Attackers have been observed using 22 distinct attack chains for reconnaissance, reading root SSH keys, and deploying the TAC Agent C2. This activity includes botnet and cryptocurrency miner deployments.

Finally, IBM Aspera Faspex versions 5.0.0 through 5.0.19 allow an authorized user to bypass authorization and gain full administrative privileges.

Why it matters

These are not theoretical bugs; they are being weaponized right now to seize control of infrastructure. The OpenSSH flaw is particularly dangerous for those running Alpine Linux or similar musl environments, as it provides a direct path for botnets to take hold. The GPUStack flaw effectively turns a same-host reverse proxy into an open door for unauthenticated attackers to control your entire AI model serving environment. If you are running these tools, you are likely already being scanned or probed.

Who is affected

• gpustack: Versions prior to 2.2.0
• SignalWire FreeSWITCH: Versions prior to 1.11.3
• OpenSSH: Versions before 10.6p2 (specifically on Linux using musl libc without PAM)
• IBM Aspera Faspex: Versions 5.0.0 through 5.0.19

What to do now

1. Upgrade gpustack to version 2.2.0 or later.
2. Upgrade FreeSWITCH to version 1.11.3 or later.
3. Upgrade OpenSSH to version 10.6p2 or later.
4. Upgrade IBM Aspera Faspex to the fixed version released in November 2026.
5. For GPUStack, set force_auth_localhost=true as a temporary workaround if you cannot upgrade immediately.

What we don't know yet

• The specific scale and total number of victims for the IBM Aspera Faspex flaw.
• The full scope of exploitation for the IBM Aspera Faspex vulnerability.
• The specific threat actors behind the FreeSWITCH and GPUStack exploitation campaigns.