Ethical Hacking News
CISA has warned of active exploitation of critical vulnerabilities in multiple systems, including GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. The agency urges federal civilian executive branch agencies to apply the fixes by November 12, 2026, citing the potential consequences of not doing so. Organizations are advised to review the identified vulnerabilities, apply the fixes, conduct regular security audits, implement robust cybersecurity measures, and stay informed about emerging threats. Immediate action is necessary to protect systems and data from exploitation.
Four critical vulnerabilities have been identified in various systems, including GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. The identified vulnerabilities pose a significant risk to system administrators and organizations that rely on these systems. The vulnerabilities are categorized under the Known Exploited Vulnerabilities (KEV) catalog and have been actively exploited. Reports of exploitation attempts have been recorded from 14 unique IP addresses, with confirmed post-exploitation activity detected from six source IP addresses. Attack chains involve reconnaissance, queries to cloud metadata services, and efforts to modify the SSH authorized_keys file to gain persistent access. The CISA warning emphasizes the need for federal civilian executive branch agencies to apply fixes by November 12, 2026. Organizations are urged to take immediate action to patch and secure these systems to minimize the risk of exploitation. Steps to take include reviewing identified vulnerabilities, applying fixes, conducting regular security audits, implementing robust cybersecurity measures, and staying informed about emerging threats.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the active exploitation of four critical vulnerabilities in various systems, including GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. This warning comes after a thorough analysis of the vulnerabilities, which have been categorized under the Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities pose a significant risk to system administrators and organizations that rely on these systems, emphasizing the need for immediate action to patch and secure these systems.
The four identified vulnerabilities are CVE-2026-123218, CVE-2026-116779, CVE-2026-123158, and CVE-2026-102895, with the latter being listed as "SSHole" due to its impact on OpenBSD OpenSSH on Linux. The CVE-2026-123218 vulnerability in IBM Aspera Faspex allows an authenticated user to bypass authorization and execute privilege escalations, while the CVE-2026-116779 vulnerability in SignalWire FreeSwitch results in configuration and credential disclosure, arbitrary call control, and command execution. The CVE-2026-123158 vulnerability in OpenBSD OpenSSH allows for authentication bypass, and the CVE-2026-102895 vulnerability in GPUStack allows for improper authentication, leading to unauthenticated administrative access and code execution.
The CISA warning highlights the active exploitation of these vulnerabilities, with reports of 22 exploitation attempts recorded from 14 unique IP addresses. According to Previdian, a threat intelligence firm, the first exploitation attempt against its honeypot network was observed on November 7, 2026, at 12:46 a.m. UTC. Confirmed post-exploitation activity has been detected from six source IP addresses, representing 18 distinct attack chains to date.
These attack chains involve reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to gain persistent access. In at least one case, unknown threat actors have been observed deploying TAC Agent, a Python-based command-and-control (C2) agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself. Threat intelligence firm watchTowr has also observed the OpenSSH flaw being weaponized in the wild for botnet and cryptocurrency miner activity.
The CISA warning emphasizes the need for federal civilian executive branch (FCEB) agencies to apply the fixes by November 12, 2026. The agency has urged system administrators to take immediate action to patch and secure these systems, citing the potential consequences of not doing so.
The exploitation of these vulnerabilities highlights the importance of staying vigilant and proactive in the face of emerging threats. It also underscores the need for organizations to prioritize cybersecurity and take proactive measures to protect their systems and data.
In light of this warning, it is essential for organizations to take the following steps:
* Review the identified vulnerabilities and their impact on your systems
* Apply the fixes and patches provided by CISA and other reputable sources
* Conduct regular security audits and vulnerability assessments to identify potential risks
* Implement robust cybersecurity measures, such as multi-factor authentication and encryption
* Stay informed about emerging threats and vulnerabilities through reputable sources
By taking these steps, organizations can minimize the risk of exploitation and ensure the security and integrity of their systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/CISA-Warns-of-Active-Exploitation-of-Critical-Vulnerabilities-in-Multiple-Systems-Urging-Immediate-Action-ehn.shtml
https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
https://nvd.nist.gov/vuln/detail/CVE-2026-123218
https://www.cvedetails.com/cve/CVE-2026-123218/
https://nvd.nist.gov/vuln/detail/CVE-2026-116779
https://www.cvedetails.com/cve/CVE-2026-116779/
https://nvd.nist.gov/vuln/detail/CVE-2026-123158
https://www.cvedetails.com/cve/CVE-2026-123158/
https://nvd.nist.gov/vuln/detail/CVE-2026-102895
https://www.cvedetails.com/cve/CVE-2026-102895/
Published: Tue Nov 10 00:59:03 2026 by llama3.2 3B Q4_K_M
