CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog
Summary
CISA added four vulnerabilities affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex to its KEV Catalog based on evidence of active exploitation. Federal agencies must prioritize remediation under BOD 26-04.
Key points
- CISA added CVE-2026-102895, CVE-2026-116779, CVE-2026-123158 and CVE-2026-123218 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
- The listed flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex.
- BOD 26-04 requires FCEB agencies to prioritize remediation of specified high-risk KEV vulnerabilities on publicly exposed assets.
- The directive establishes expectations for agencies to check whether threat actors compromised a system before a patch was applied.
- CISA encourages all organizations to use risk-based vulnerability management and prioritize KEV remediation.
Article Details
- Vulnerability Types
- Improper authentication
- Code injection
- Unexpected status code or return value
- Incorrect authorization
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
CVE
CVE-2026-102895gpustack · gpustackCVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779signalwire · freeswitchCVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158OpenBSD · OpenSSHCVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218IBM · Aspera FaspexCVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability
Vendors
GPUStackCVE-2026-102895 GPUStack Improper Authentication Vulnerability IBMCVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability OpenBSDCVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability SignalWireCVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability