Illustrative image: a data centre. Image: BalticServers / Wikimedia Commons, CC BY-SA 3.0
Update — 11 November 2026: six more flaws join the KEV list
One day after the four flaws above, CISA added six more actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Monday 10 November 2026 (catalog version 2026.11.10). The two Barracuda flaws carry the same three-day urgency as the first batch — US federal agencies must fix them by Thursday 13 November 2026. The other four have a federal deadline of Monday 24 November 2026. As with the first batch, CISA lists known ransomware campaign use as "Unknown" for all six — it has not confirmed ransomware involvement, not ruled it out.
| CVE | Product | What it does | Federal deadline | Fix |
|---|---|---|---|---|
| CVE-2026-116606 | Barracuda Email Security Gateway | Pre-authentication authorisation bypass (CVSS 9.3) | 13 November 2026 | ESG firmware 9.4.0.029 or later; patch BNSF-40425 (firmware 9.4.017+) or BNSF-40430 (older) |
| CVE-2026-111560 | Barracuda ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center, Web Security Gateway | Operating-system command injection in the timezone setting (CVSS 8.6) | 13 November 2026 | Apply Barracuda's per-product patch (BNADC-16586 for ADC/WAF, BNMA-32468 for Archiver, BNWF-60060 for WAF Control Center, BNYF-24789 for Web Security Gateway) |
| CVE-2026-20320 | Cisco BroadWorks | Improper restriction of XML external entity reference (XXE) | 24 November 2026 | Apply Cisco's fix — see the vendor advisory |
| CVE-2026-111793 | Openwave Webtop Media Transcoder | Incorrect resource transfer between spheres — an authenticated user can process unintended document types | 24 November 2026 | Apply the vendor's fix |
| CVE-2026-124194 | Microsoft Office Outlook | Missing user interaction for a potentially unsafe action | 24 November 2026 | Apply Microsoft's November update for Outlook |
| CVE-2026-125350 | Google Chrome / Chromium | Use-after-free in the XML component, exploited in the wild | 24 November 2026 | Chrome Stable 157.0.8103.50/.51 (Windows and macOS), 157.0.8103.50 (Linux); Extended Stable 156.0.8078.96 |
The Barracuda pair is the urgent one. Barracuda published patches on 2 November, but on 9 November it updated its advisory to say it had "identified exploitation activity affecting a small number of organizations". The two flaws chain together: the authorisation bypass (CVE-2026-116606) needs no login — only access to the product's administrative interface — and the command injection (CVE-2026-111560) then runs commands as root. Security researchers published the full chain and a working exploit tool on 5 November, so the window between patch and public exploit is already closed. If your Barracuda admin interface is reachable from the internet, patching by 13 November is the minimum — restricting admin access to trusted networks is the lasting fix.
The Chrome flaw affects almost everyone reading this. CVE-2026-125350 is a use-after-free bug in Chrome's XML component, reported anonymously to Google on 6 November. Google confirmed on 9 November that an exploit "exists in the wild" — the eighth Chrome zero-day exploited in attacks this year. Google has not named the attackers, the targets or the delivery method, and the bug details are restricted while users update. The fix is already rolling out: check Help → About Google Chrome and relaunch when it asks. If your version reads 157.0.8103.50 or higher, you are covered; organisations on Extended Stable need 156.0.8078.96.
What this means for the 12 November deadline in the original post: nothing changes for the first four flaws — GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex still carry the 12 November federal deadline, and the fixes listed above still stand. The catalog simply grew: ten exploited flaws added in two days, with three different deadlines (12, 13 and 24 November). If you run Barracuda appliances, your deadline is now Thursday 13 November. If you use Chrome or Outlook, update them this week — the 24 November date is the federal deadline, not a reason to wait.
TL;DR — CISA KEV November 2026 explained: On Monday 9 November 2026, CISA added four actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog — GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex. Three score 9.8 out of 10. US federal agencies must patch by Thursday 12 November; everyone else should treat that date as their deadline too.
📌 Key Highlights
- Four flaws, one deadline: CISA added CVE-2026-102895 (GPUStack), CVE-2026-116779 (FreeSWITCH), CVE-2026-123158 (OpenSSH) and CVE-2026-123218 (IBM Aspera Faspex) to KEV on 9 November 2026, with a federal remediation deadline of 12 November 2026.
- Three are critical: GPUStack, FreeSWITCH and IBM Aspera Faspex all score 9.8 on the CVSS scale; the OpenSSH flaw, nicknamed "SSHole", scores 8.1.
- Attacks are already happening: KEV listing means CISA has evidence of active exploitation — GPUStack and FreeSWITCH exploitation is confirmed by the vendors, and researchers logged 22 SSHole attempts from 14 IP addresses since 6 November.
- Fixes already exist: GPUStack 2.2.0, FreeSWITCH 1.11.3, OpenSSH 10.6p2 and IBM Aspera Faspex 5.0.19 PL1 — every flaw on the list has a patch waiting.
- India angle: AI teams running GPU clusters, VoIP and call-centre providers, and anyone running Alpine Linux containers should check their versions today, not on 12 November.
What happened?
On Monday 9 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — the list reserved for flaws with confirmed evidence of attacks in the wild. The catalog version is 2026.11.09. Under Binding Operational Directive 26-04, US federal civilian agencies must remediate all four by Thursday 12 November 2026, and complete forensic triage on the affected systems. CISA lists ransomware campaign use as "Unknown" for all four — meaning it has not confirmed ransomware involvement, not that it has ruled it out.
The KEV catalog is not a list of theoretical risks: a flaw lands on it only when CISA has evidence that attackers are already using it, which is why the deadline is just three days — these are not flaws to schedule for next month's maintenance window. CISA also added a SonicWall SSL-VPN flaw to KEV on 6 November, with a 20 November deadline, which we covered in its own post.
CISA KEV November 2026 explained: the four flaws at a glance
| CVE | Product | CVSS | What it does | Fix |
|---|---|---|---|---|
| CVE-2026-102895 | GPUStack | 9.8 Critical | Unauthenticated admin access to AI GPU clusters | Upgrade to 2.2.0 |
| CVE-2026-116779 | SignalWire FreeSWITCH | 9.8 Critical | A SIP text message runs server commands | Upgrade to 1.11.3 |
| CVE-2026-123158 | OpenBSD OpenSSH ("SSHole") | 8.1 High | Long password logs in to password-less accounts | Upgrade to OpenSSH 10.6p2 |
| CVE-2026-123218 | IBM Aspera Faspex | 9.8 Critical | Authorised user bypasses authorisation, gains admin | Upgrade to 5.0.19 PL1 |
All four were added to KEV on 9 November 2026. All four carry the same 12 November 2026 federal deadline. Below is what each one actually does, in plain language.
GPUStack CVE-2026-102895: the AI-cluster admin bypass
GPUStack is open-source software for running AI model clusters and provisioning GPU instances — the kind of tool AI startups and research labs use to share expensive graphics cards across a team. The flaw is in how it decides who is an administrator. In GPUStack versions before 2.2.0, the get_current_user function promotes any request it believes comes from the same machine (loopback, 127.0.0.1) to the built-in administrator account, when the force_auth_localhost setting is off — which is the default.
The problem is that "comes from the same machine" can be faked. The vendor advisory describes two paths. First, the standard self-hosted setup puts GPUStack behind a same-host reverse proxy, so every remote request arrives with a TCP peer address of 127.0.0.1 — the loopback check fires for everyone. Second, a forged X-GPUStack-Real-IP: 127.0.0.1 header can make the request look local. Either path gives full, unauthenticated administrative access over the network: enumerate and modify users, models, workers and configuration; mint persistent admin API keys that stay valid from any IP address afterwards; read worker credentials and cloud-provider secrets; and run code on worker hosts through the POST /v2/inference-backends/from-yaml endpoint.
This is not theoretical. The advisory states the flaw "has been observed exploited in the wild against a v2.1.1 deployment", where attackers created custom backends running reverse shells. It was independently reported by Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University; the in-the-wild exploitation was reported by Javier Sixto. The fix shipped in GPUStack 2.2.0 in July 2026, which removed the loopback auto-admin path entirely. If you cannot upgrade immediately, set force_auth_localhost=true, strip client-supplied X-GPUStack-Real-IP headers at the edge, and keep the API off untrusted networks. After upgrading, review admin API keys and inference backends created from YAML — attacker-minted keys stay valid after the patch.
Illustrative image: servers in a data centre. Image: Ana Las Heras / Wikimedia Commons, CC BY-SA 4.0
FreeSWITCH CVE-2026-116779: a text message that runs commands
FreeSWITCH is open-source phone-system software used by VoIP providers, call centres and unified-communications platforms. The flaw is in how it handles inbound SIP MESSAGE — SIP's text-message mechanism. The handler splits the recipient address on the "+" character and treats the left half as a chat protocol name, dispatching the message to whichever registered chat interface matches. One of those interfaces is called api, registered by mod_dptools, and it hands its content straight to switch_api_execute(). So a peer that can deliver a single SIP MESSAGE to a profile can choose which FreeSWITCH API command the server runs.
The impact is command execution with the privileges of the FreeSWITCH process: arbitrary operating-system commands, disclosure of configuration and credentials, and full control over calls. Where mod_lua is loaded — as the stock configuration does — inline Lua code is reachable as a second route. The advisory confirms exploitation of this path "has been observed in the wild". The flaw was reported by Örn Arnarson and Gunnlaugur.
The exposure is wider than it looks. Any SIP profile that accepts inbound MESSAGE is affected, and that is the default posture: chat handling is on unless a profile sets enable-chat=false, and the stock configuration leaves it on for both the internal and external profiles. Tightening the inbound access list does not help — it does not cover MESSAGE. Where message authentication is enforced, any single account on the profile is enough to send the message, and installations still carrying the stock default directory user — an account with no password at all — need no account of their own. The immediate workaround is enable-chat=false on every profile that does not need inbound SIP chat. The fix, in FreeSWITCH 1.11.3, adds a new enable-chat-api-proto parameter that is off unless explicitly set, so the command route is closed by default.
OpenSSH "SSHole" CVE-2026-123158: the long-password login
The third flaw has the most memorable name of the four. Nicknamed "SSHole" by the researcher who found it, CVE-2026-123158 is an authentication bypass in OpenSSH's server, sshd, on Linux systems built with the musl C library and without PAM — the login framework most distributions route passwords through. It was reported to OpenSSH by Özgün Kültekin of Wakefield on 4 November; OpenSSH shipped the fix, version 10.6p2, the next day, calling it a "critical security workaround". For the full mechanism and fix, see our detailed OpenSSH 10.6p2 post.
The mechanism is a quirk of the musl library: when sshd checks a password itself instead of handing it to PAM, it hashes the submitted password with the C library's crypt function and compares the result with the stored value. On musl, crypt returns a single asterisk (*) for any password longer than 256 bytes — and an asterisk is exactly what the password field holds for an account with no usable password — so a password of 256 to 1,024 characters is accepted for those accounts. Alpine Linux is the best-known platform built this way: its standard openssh-server package ships without PAM. Debian, Ubuntu, Fedora and other glibc-based systems are not affected, and neither is any sshd that checks passwords through PAM or has password authentication switched off.
Attackers moved fast. Researchers at Previdian recorded 22 exploitation attempts from 14 unique IP addresses from 6 November, and GreyNoise logged the first honeypot attempt at 12:46 AM UTC on 7 November. The fix is OpenSSH 10.6p2, or your distribution's patched package — Alpine shipped fixed packages for every supported branch on 5 November. If you run Alpine-based containers or servers with an SSH server inside, check now: the people most at risk may not realise they run an exposed service.
IBM Aspera Faspex CVE-2026-123218: already covered here
The fourth flaw on CISA's list is the IBM Aspera Faspex incorrect-authorisation vulnerability, which we covered in detail in our post on the IBM Aspera Faspex flaw: an authenticated user can craft a specific message to bypass authorisation checks and escalate to full administrative privileges. IBM fixed it in Aspera Faspex 5.0.19 PL1, released in November 2026. It carries the same 12 November federal deadline as the other three — upgrade to 5.0.19 PL1 and confirm the faspex-core container image reads 5.0.19, Fix Pack 1.
Why it matters for India readers
None of these four flaws is a consumer-phone problem, but all four touch infrastructure that Indian organisations run every day. GPUStack sits in front of the GPU clusters that Indian AI startups, research labs and enterprises use to serve models — and the flaw needs no credentials at all when the usual reverse-proxy setup is in place. FreeSWITCH powers VoIP and call-centre systems, a large industry in India, and the attack needs only a single SIP message. Alpine Linux is the base image of choice for countless Docker containers in Indian cloud deployments, and an Alpine container running its own SSH server is exactly the shape SSHole targets. IBM Aspera Faspex moves large media and research files for studios and labs.
The 12 November deadline technically binds only US federal civilian agencies, but CISA sets three-day deadlines for one reason: the flaws are already being used. Indian teams should treat 12 November as their own patch date — and with SAP's November Patch Day, carrying four CVSS 10.0 flaws, landing the same week, this is a heavy patching week, not a single incident.
What to do before 12 November
| If you run… | Do this now |
|---|---|
| GPUStack before 2.2.0 | Upgrade to 2.2.0 or later. Then audit admin API keys and inference backends created from YAML — attacker-minted keys survive the patch. Until then, set force_auth_localhost=true and strip client-supplied X-GPUStack-Real-IP headers at the edge. |
| FreeSWITCH | Upgrade to 1.11.3. Until then, set enable-chat=false on every SIP profile that does not need inbound chat, and remove directory users with no password. |
| OpenSSH on musl Linux (Alpine) | Upgrade to OpenSSH 10.6p2 or your distribution's patched package. Check sshd -T for PasswordAuthentication and UsePAM — accounts with a * password field are the ones at risk. |
| IBM Aspera Faspex before 5.0.19 PL1 | Upgrade to 5.0.19 PL1 and verify the faspex-core image version. |
| None of the above | Still check: GPUStack and FreeSWITCH can sit behind other services, and Alpine containers often run SSH without anyone remembering. Search your inventory for all four products. |
CISA also requires federal agencies to complete forensic triage — checking whether the flaw was already used against them. Private teams should do the same: GPUStack admins should look for unfamiliar admin API keys and backends, FreeSWITCH admins for unexpected API calls, and SSH admins for logins to accounts that should have no password.
Should you care?
✅ Yes — if you run any of the four products, patch before Thursday 12 November. All four flaws have confirmed exploitation evidence, three score 9.8, and every one has a fix already released. The GPUStack flaw is the most dangerous: it needs no credentials and hands over an entire AI cluster. The FreeSWITCH flaw needs only one text message. The OpenSSH flaw affects a narrow setup, but Alpine containers with SSH are common and easy to overlook. ⏳ If you run none of them, there is nothing to install — but this is still the week to check, because a forgotten container or an old VoIP server is exactly how these flaws get in.
FAQs
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog is CISA's list of flaws with confirmed evidence of exploitation in the wild. US federal civilian agencies must fix listed flaws by the catalog's due date under Binding Operational Directive 26-04. A KEV listing means attackers are already using the flaw — it is not a prediction.
What is the deadline to patch the November 2026 CISA KEV flaws?
Thursday 12 November 2026 for the four flaws added on 9 November — GPUStack CVE-2026-102895, FreeSWITCH CVE-2026-116779, OpenSSH CVE-2026-123158 and IBM Aspera Faspex CVE-2026-123218. The deadline binds US federal agencies, but every organisation should treat it as its own patch date. The SonicWall flaw added on 6 November has a later deadline, 20 November 2026.
Am I affected by the OpenSSH SSHole flaw?
Only if your server runs OpenSSH on musl-based Linux without PAM — Alpine Linux is the main case — with password authentication enabled and an account whose password field is an asterisk. Debian, Ubuntu, Fedora, other glibc-based systems and any setup using PAM are not affected. If you are affected, upgrade to OpenSSH 10.6p2 or your distribution's patched package.
What is GPUStack CVE-2026-102895?
An improper-authentication flaw in GPUStack, the open-source AI model cluster manager. Before version 2.2.0, requests that appear to come from the local machine are treated as the built-in administrator — and a reverse proxy or a forged header can make any remote request look local. An unauthenticated attacker gains full admin access, including creating persistent admin API keys and running code on worker hosts. It was observed exploited in the wild against version 2.1.1.
Takeaway
Four flaws, three days, and every fix already released — the 9 November KEV additions are a patching sprint, not a research project. GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex are all being exploited in the wild right now, and the fastest win is simply to check which of the four you run and install the update before Thursday 12 November.
Start with the version check: GPUStack 2.2.0, FreeSWITCH 1.11.3, OpenSSH 10.6p2 and Aspera Faspex 5.0.19 PL1 are the numbers to look for.
Sources
- CISA — Known Exploited Vulnerabilities Catalog (catalog version 2026.11.09, 9 November 2026)
- CISA — Known Exploited Vulnerabilities JSON feed (four entries added 9 November 2026, due 12 November 2026)
- GPUStack — Security advisory GHSA-gj9m-f8ph-pmhr (CVE-2026-102895, fixed in 2.2.0)
- SignalWire FreeSWITCH — Security advisory GHSA-mg63-h38w-8p9p (CVE-2026-116779)
- OpenSSH — Release notes, Portable OpenSSH 10.6p2 (5 November 2026)
- The Hacker News — CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws (10 November 2026)
- SecurityWeek — IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks (10 November 2026)
- CISA — "CISA Adds Six Known Exploited Vulnerabilities to Catalog" (10 November 2026)
- CISA — Known Exploited Vulnerabilities JSON feed (catalog version 2026.11.10; six entries added 10 November 2026, due 13 and 24 November 2026)
- TSN — "Barracuda Vulnerabilities Patched in Six Products" (10 November 2026 update: exploitation confirmed, KEV listing, patch IDs)
- Google — Chrome Releases, "Stable Channel Update for Desktop" (9 November 2026)
- Malwarebytes — "Update Chrome now to fix a flaw attackers are exploiting" (10 November 2026)
Comments
Post a Comment