CISA adds four actively exploited flaws to KEV — patch deadline November 12
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, November 9, citing evidence of active exploitation, with a November 12 remediation deadline for federal civilian agencies. The four span GPUStack, SignalWire FreeSWITCH, OpenSSH — the 'SSHole' flaw — and IBM Aspera Faspex. Three of the four carry a near-maximum CVSS score of 9.8. CrowdStrike and Palo Alto Networks are sector read-throughs.
📊 Scorecard: our Bearish call on $IBM is a hit so far: from $246.11 to $244.53 at the latest close (-0.6%). Against QQQ the call is even: the stock is level with the index.
The News
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday, November 9, citing evidence of active exploitation, with a November 12 remediation deadline for federal civilian agencies under Binding Operational Directive 26-04, plus forensic triage, according to CISA's KEV catalog entries. The fix versions and flaw mechanics below are from the vendors' advisories — GPUStack, SignalWire FreeSWITCH, OpenSSH and IBM — not from the news report alone. The KEV catalog is the US government's list of flaws attackers are actually exploiting — not just flaws that could be exploited — and it is widely used by companies as a patch-first priority queue. The three-day deadline is unusually short, and CISA's notes tell agencies to discontinue use of the affected software if mitigations are not available.
The four flaws: CVE-2026-102895 in GPUStack, CVSS 9.8 — improper authentication, where a remote request can pass as loopback traffic and be treated as a built-in admin, fixed in version 2.2.0 in July 2026. CVE-2026-116779 in SignalWire FreeSWITCH, CVSS 9.8 — code injection via SIP chat, with configuration and credential disclosure and command execution, fixed in 1.11.3 in October 2026. CVE-2026-123158, known as 'SSHole,' in OpenBSD OpenSSH on Linux, CVSS 8.1 — an authentication bypass on musl-libc systems without PAM, fixed in 10.6p2 in November 2026. And CVE-2026-123218 in IBM Aspera Faspex, CVSS 9.8 — incorrect authorization letting an authenticated user escalate to admin, fixed in 5.0.19 PL1 in November 2026. CVSS is a 0-to-10 severity score; 9.8 is near the top of the scale.
The SSHole listing is the new development for the flaw disclosed in the first week of November, with exploitation attempts reported since November 6. Exploitation attempts have run since November 6: 22 attempts from 14 IP addresses according to Previdian, a first honeypot hit on November 7 at 00:46 UTC according to GreyNoise, and confirmed post-exploitation from six IP addresses across 18 attack chains, including cloud-metadata queries, password-hash and root SSH-key reads, and tampering with authorized_keys files. WatchTowr reports weaponisation for botnet and crypto-miner activity. Ransomware-campaign use is unknown for all four flaws, and CISA has not named attackers or victim counts.
Four actively exploited flaws, three at near-maximum severity, and a three-day deadline — CISA is telling agencies to patch or stop using the software.
Why It Matters
This matters because a KEV listing is the moment a theoretical flaw becomes a live one. CISA only adds a vulnerability to the catalog when it has evidence of active exploitation, and the three-day deadline is the tell: the agency is not giving federal departments a normal patch window, it is giving them a countdown. The instruction to discontinue use if mitigations are not available is CISA's standard wording when no fix can be applied — it means the risk of running the software outweighs the cost of turning it off.
It matters for the companies running this software, because the fixes already exist and the exploitation is already happening. GPUStack was fixed in July, FreeSWITCH in October, OpenSSH and Faspex this month — yet attackers are still finding unpatched systems, and for SSHole they moved within a day of the flaw going public. The telemetry shows what happens next when they get in: cloud-metadata queries, password hashes, root SSH keys, and tampering with authorized_keys files — the steps an attacker takes to make sure they can come back. That is the pattern of a foothold being built, not a probe being run.
And it matters for the security sector, because every KEV wave is a demand signal. IBM carries the direct exposure here through Aspera Faspex, but the read-through is CrowdStrike and Palo Alto Networks: their customers are the ones being told to patch in three days, and the ones who will pay for detection when patching is not fast enough. The bearish read is not that the vendors lose — it is that the attack surface keeps widening faster than the patching keeps up.
Analyst's Take
Our call is Bearish. Four flaws at once, three of them at 9.8 severity, and a three-day deadline is not a routine patch cycle — it is CISA saying the exploitation is real and the window is short. The SSHole telemetry is the proof: 22 attempts from 14 IP addresses recorded by Previdian since November 6, and separately, GreyNoise confirming post-exploitation from six IP addresses across 18 attack chains, with the attackers going straight for cloud credentials and root SSH keys. That is not scanning; that is exploitation with a purpose. For IBM, the Faspex flaw is a privilege-escalation hole in a file-transfer product used to move large files — the kind of system that sits on the edge of a network and holds the keys to what is behind it. But keep the scale in proportion: Faspex is one small product line inside IBM, so this is a patching risk for its users, not a company-level event for IBM shares — while CrowdStrike and Palo Alto Networks, the other tickers here, stand to gain from the demand signal, not lose from it.
What to watch: whether the November 12 deadline holds or CISA extends it, and whether any victim names or ransomware links emerge. The 'who and how many victims' question is still open — CISA has named neither. The counter-case for the sector is that a KEV listing is also a sales event for the security vendors: CrowdStrike and Palo Alto Networks are the read-throughs here, and every KEV wave is a reminder to their customers why they pay for detection. But the immediate read is the risk: three near-maximum-severity flaws, all actively exploited, all with fixes already available — and a deadline measured in days, not weeks.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is CISA's KEV catalog, in plain terms?
It is the US government's list of software flaws that attackers are actually exploiting in the wild — not just flaws that could be exploited. When a flaw lands on the list, US federal civilian agencies must fix it by the stated deadline. The list is widely used by companies as a patch-first priority queue.
What is the November 12 deadline?
Federal civilian agencies must remediate all four flaws by November 12 under CISA's Binding Operational Directive 26-04, plus carry out forensic triage. That is a three-day deadline — the shortest window under the directive, which replaced the old 21-day patch clock in June 2026 — and CISA's notes tell agencies to discontinue use of the affected software if mitigations are not available.
What is the 'SSHole' flaw?
CVE-2026-123158, an authentication bypass in OpenBSD OpenSSH running on Linux systems that use musl-libc without PAM — a common setup in lightweight containers. Attackers can log in without a valid credential. It was fixed in OpenSSH 10.6p2 in November 2026. Exploitation attempts have run since November 6.
How bad is the exploitation so far?
For SSHole, the telemetry is concrete: 22 exploitation attempts from 14 IP addresses according to Previdian, a first honeypot hit on November 7 at 00:46 UTC according to GreyNoise, and confirmed post-exploitation from six IP addresses across 18 attack chains — including cloud-metadata queries, password-hash and root SSH-key reads, and tampering with authorized_keys files. WatchTowr reports weaponisation for botnet and crypto-miner activity.
What are the other three flaws?
CVE-2026-102895 in GPUStack (CVSS 9.8) lets a remote request pass as loopback traffic and be treated as a built-in admin; fixed in version 2.2.0 in July 2026. CVE-2026-116779 in SignalWire FreeSWITCH (CVSS 9.8) allows code injection via SIP chat, with configuration and credential disclosure and command execution; fixed in 1.11.3 in October 2026. CVE-2026-123218 in IBM Aspera Faspex (CVSS 9.8) lets an authenticated user escalate to admin; fixed in 5.0.19 PL1 in November 2026.
👁
Source: The Hacker News