Four Flaws Hit the Exploited List. Patch by November 12.

Four more flaws just earned the label no administrator wants to see. On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — the list reserved for flaws with confirmed evidence of attacks in the wild. Federal civilian agencies have until Thursday, November 12, 2026, to apply the fixes. Everyone else should treat that date as their deadline too.

The KEV catalog is not a list of theoretical risks. A flaw lands there only when CISA has evidence that attackers are already using it. All four of these flaws carry that evidence, and three of them score 9.8 out of 10 — the near-maximum severity rating.

The four flaws

CVE-2026-123218 — IBM Aspera Faspex (9.8). An incorrect authorization flaw in IBM’s high-speed file transfer product. An authenticated user can craft a specific message to bypass authorization checks and escalate privileges. IBM fixed it in November 2026.

CVE-2026-116779 — SignalWire FreeSWITCH (9.8). A code injection flaw in the open-source phone system software. Exploiting it can expose configuration files and credentials, give an attacker control over calls, and run commands on the server. It was fixed in October 2026.

CVE-2026-123158 — OpenSSH, known as SSHole (8.1). An authentication bypass in OpenBSD OpenSSH running on Linux. When a server has accounts with no password set, the flaw can let an attacker sign in anyway. It was fixed in November 2026, and it is the one flaw on this list with the most visible exploitation so far.

CVE-2026-102895 — GPUStack (9.8). An improper authentication flaw in the AI model management platform. An unauthenticated attacker can gain full administrative access — changing users and models, creating persistent admin API keys, reading worker and cloud-provider secrets, and running code through a single API endpoint. It was fixed in July 2026, but the flaw’s maintainers noted that active exploitation in the wild had already been reported.

SSHole is already burning

The SSHole flaw deserves the closest look, because the attacks are not hypothetical. Security researchers have recorded 22 exploitation attempts from 14 unique IP addresses since November 6. The first attempt against GreyNoise’s honeypot network arrived on November 7 at 12:46 a.m. UTC. Since then, researchers have confirmed 18 distinct attack chains from six source addresses.

Those attacks are not drive-by scans. The chains include reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to keep access after the break-in. In at least one case, attackers deployed TAC Agent, a Python-based command-and-control tool that can run shell commands, map the system, move files, and update itself. Researchers at watchTowr have also seen the flaw weaponized for botnet and cryptocurrency mining activity.

This blog covered the first confirmed break-ins last week — the patch arrived first, and the attacks followed within hours — and the picture has only gotten worse since. The KEV listing is CISA’s formal confirmation that the exploitation is real and ongoing.

What to do now

Patch all four, starting with what faces the internet. The fixes exist for every flaw on the list. GPUStack’s fix has been available since July, FreeSWITCH’s since October, and the Faspex and OpenSSH fixes since this month. If any of these four products run in your environment, check the version today, not Thursday.

Check your SSH servers for signs of SSHole. Look for logins to accounts that have no password set, unexpected entries in authorized_keys files, and any sign of the TAC Agent implant. If a server was reachable on port 22 with the vulnerable OpenSSH build, treat it as potentially compromised until the logs say otherwise.

Audit GPUStack admin access. Review the admin API keys on any GPUStack deployment and revoke anything created recently that you cannot explain. Check for unexpected user or model changes and for worker or cloud-provider secrets that may have been read.

Lock down the admin panels. The Faspex and FreeSWITCH flaws both reward an attacker who can reach the product’s administrative interface. Those interfaces belong on trusted internal networks, behind a VPN — never on the open internet.

The KEV catalog exists because the window between disclosure and exploitation has collapsed. The SonicWall flaw that joined the list last week had a November 20 deadline; this batch gives federal agencies three days. When CISA says a flaw is being exploited, the clock is not a suggestion. Patch first, hunt second, and do both before Thursday.