Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical flaws to its Known Exploited Vulnerabilities (KEV) catalog, marking a growing threat landscape for organizations worldwide. These vulnerabilities include an improper authentication vulnerability in GPUStack, a code injection vulnerability in SignalWire FreeSwitch, an authentication bypass vulnerability in OpenSSH, and an incorrect authorization vulnerability in IBM Aspera Faspex. Organizations are urged to review the KEV catalog and address these vulnerabilities in their infrastructure to prevent potential cyber attacks.
Four critical vulnerabilities have been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, and CVE-2026-123218. CVE-2026-102895 is an improper authentication vulnerability in GPUStack, while CVE-2026-116779 is a code injection vulnerability in SignalWire FreeSWITCH. CVE-2026-123158 is an authentication bypass vulnerability affecting OpenSSH, and CVE-2026-123218 is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. These vulnerabilities have been added due to observed exploitation in the wild and require immediate attention from organizations to protect their networks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added four critical flaws to its Known Exploited Vulnerabilities (KEV) catalog, marking a growing threat landscape for organizations worldwide. The four vulnerabilities, identified by CISA, are: CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, and CVE-2026-123218.
The first vulnerability, CVE-2026-102895, is an improper authentication vulnerability in GPUStack, an open-source platform used to manage GPU clusters and AI model deployments. This vulnerability allows remote, unauthenticated attackers to bypass authentication and obtain administrator privileges, potentially exposing sensitive information, creating persistent administrator API keys, modifying configurations, and executing arbitrary code. According to Javier Sixto, a security researcher, exploitation of this vulnerability has been observed in the wild against a GPUStack 2.1.1 deployment.
The second vulnerability, CVE-2026-116779, is a code injection vulnerability in SignalWire FreeSWITCH, an open-source communications platform. This vulnerability allows attackers to send specially crafted SIP MESSAGE requests and abuse the API chat protocol to execute FreeSWITCH API commands, potentially exposing credentials and configuration data, manipulating telephone calls, and executing operating system commands with the privileges of the FreeSWITCH process. SignalWire confirmed that exploitation of this vulnerability has been observed in the wild.
The third vulnerability, CVE-2026-123158, is an authentication bypass vulnerability affecting OpenSSH. When OpenSSH runs on Linux systems using the musl C library without Pluggable Authentication Modules (PAM), the SSH server may incorrectly interpret password input as a password hash. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted password to bypass authentication and access affected accounts. CISA added this vulnerability to its KEV catalog on November 6, 2026, indicating that exploitation has been observed.
The fourth vulnerability, CVE-2026-123218, is an incorrect authorization vulnerability affecting IBM Aspera Faspex 5. It allows an authenticated user to craft a specific message that bypasses authorization checks and potentially gain full administrative privileges. Successful exploitation could give attackers access to sensitive information and allow them to modify or disrupt the affected system. IBM disclosed the vulnerability on November 7, 2026, and released a fix in Aspera Faspex 5.0.19 PL1.
These four vulnerabilities have been added to the CISA's KEV catalog, which provides organizations with critical information to address known exploited vulnerabilities. According to CISA's Binding Operational Directive (BOD) 22-01, federal agencies must address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure.
The addition of these four vulnerabilities to the KEV catalog highlights the growing threat landscape for organizations worldwide. As technology continues to evolve, it is essential for organizations to stay vigilant and proactive in addressing known exploited vulnerabilities to prevent potential cyber attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-IBM-SignalWire-FreeSwitch-OpenSSH-and-GPUStack-Flaws-to-Its-Known-Exploited-Vulnerabilities-Catalog-A-Growing-Threat-Landscape-ehn.shtml
https://securityaffairs.com/202813/hacking/u-s-cisa-adds-ibm-signalwire-freeswitch-openssh-and-gpustack-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-102895
https://www.cvedetails.com/cve/CVE-2026-102895/
https://nvd.nist.gov/vuln/detail/CVE-2026-116779
https://www.cvedetails.com/cve/CVE-2026-116779/
https://nvd.nist.gov/vuln/detail/CVE-2026-123158
https://www.cvedetails.com/cve/CVE-2026-123158/
https://nvd.nist.gov/vuln/detail/CVE-2026-123218
https://www.cvedetails.com/cve/CVE-2026-123218/
Published: Tue Nov 10 16:42:04 2026 by llama3.2 3B Q4_K_M
