CISA added four actively exploited vulnerabilities affecting IBM Aspera Faspex, SignalWire FreeSWITCH, OpenSSH on Linux and GPUStack to its Known Exploited Vulnerabilities catalog on November 9, 2026, and urged administrators to install available fixes.

The most severe issues include a CVSS 9.8 authorization bypass in IBM Aspera Faspex and a CVSS 9.8 code-injection flaw in FreeSWITCH, alongside a CVSS 9.8 authentication bypass in GPUStack and the CVSS 8.1 OpenSSH flaw known as SSHole.

In IBM Aspera Faspex versions 5.0.0 through 5.0.19, crafted messages can let an authenticated user bypass authorization and gain administrator privileges; IBM fixed the issue in version 5.0.19 PL1 and later.

SignalWire released FreeSWITCH 1.11.3 with a fix for CVE-2026-116779, which has been exploited in the wild, though its advisory provided no details about the attacks.

The FreeSWITCH flaw involves inbound SIP MESSAGE requests with a plus sign in the recipient field, which can let a peer influence the API command the server executes; default profiles enable inbound chat, and some configurations may be vulnerable through directory users without password material.

The FreeSWITCH vulnerability can expose sensitive information, enable arbitrary call control and allow code execution with the privileges of the FreeSWITCH process; version 1.11.3 and later addresses it.

GPUStack’s CVE-2026-102895 can give unauthenticated remote attackers administrative access, expose secrets and enable code execution; Ulex Innovative Systems’ Javier Sixto reported active exploitation.

CISA also flagged the GPUStack flaw as exploited, noting it had been identified as under attack at the end of July.

SSHole, CVE-2026-123158, affects a narrow Linux configuration and can allow remote attackers to access accounts, including root; OpenSSH 10.6p2 and later fixes the issue.

The SSHole vulnerability occurs when musl libc is used without PAM and at least one account has a SHA-256 or SHA-512 password hash; under those conditions, an account without a password may accept any password 257 to 1,024 characters long.

SSHole attack attempts were reported beginning November 6, with Previdian recording 22 attempts from 14 unique IP addresses and GreyNoise observing post-exploitation activity from six IPs across 18 attack chains.

Observed SSHole activity has included reconnaissance, cloud metadata queries, attempts to access password hashes and root SSH keys, and changes to authorized_keys for persistence; researchers also reported TAC Agent deployment and botnet and cryptocurrency-mining activity.