CISA Adds Four Product Flaws to KEV Catalog, Citing Active Exploitation
Summary
CISA added flaws affecting GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to its KEV catalog, citing active exploitation. Reports detail activity against the OpenSSH flaw; exploitation details for the other flaws remain unavailable.
Key points
- CISA added four vulnerabilities affecting GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog.
- Previdian reported 22 exploitation attempts against CVE-2026-123158 from 14 IP addresses since November 6, 2026.
- GreyNoise observed 18 distinct attack chains from six source IP addresses, including reconnaissance, cloud metadata queries, attempts to read password hashes and root SSH keys, and changes to authorized_keys.
- In at least one observed case, an unknown actor dubbed GT10 deployed TAC Agent, a Python-based command-and-control agent with shell execution, reconnaissance and file-transfer capabilities.
- watchTowr reported observing the OpenSSH flaw weaponized for botnet and cryptocurrency-mining activity.
- The article says public reporting on exploitation methods, actors and scale for the other vulnerabilities was unavailable; FCEB agencies were advised to apply fixes by November 12, 2026.
Article Details
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.004 · Unix ShellTAC Agent is described as capable of executing shell commands.T1082 · System Information DiscoveryThe reported post-exploitation activity included system reconnaissance.T1083 · File and Directory DiscoveryThe TAC Agent is described as capable of directory enumeration.T1098.004 · SSH Authorized KeysAttackers attempted to modify the SSH authorized_keys file to gain persistent access.T1552.004 · Private KeysReported attack chains included attempts to read root SSH keys.T1552.005 · Cloud Instance Metadata APIReported attack chains included queries to cloud metadata services.
CVE
CVE-2026-102895gpustack · gpustackIn an advisory for CVE-2026-102895 published on July 31, 2026, the maintainers of the GPUStack Python package credited Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for independently reporting the flaw, addingCVE-2026-123158OpenBSD · OpenSSHThe addition of CVE-2026-123158 to the KEV catalog follows reports of exploitation attempts targeting the flaw since November 6, 2026. A total of 22 exploitation attempts have been recorded from 14 unique IP addresses
People
Haoyu WangCredited by the GPUStack Python package maintainers with independently reporting CVE-2026-102895.Javier SixtoUlex Innovative Systems' advisory reportedly attributed reports of active in-the-wild exploitation of CVE-2026-102895 to him.Nikko EnggalianoCredited by the GPUStack Python package maintainers with independently reporting CVE-2026-102895.Rui YangCredited by the GPUStack Python package maintainers with independently reporting CVE-2026-102895.Wei YunzhouCredited by the GPUStack Python package maintainers with independently reporting CVE-2026-102895.
Threat Actors
Malware
Products
FreeSwitchSecurity Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citingGPUStackCybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited VulnerabilitiesIBM Aspera FaspexMonday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.OpenSSHAgency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active