CISA KEV Alert (November 2026): Four Actively Exploited CVEs — GPUStack, FreeSWITCH, OpenSSH, and IBM Aspera Faspex Detection and Remediation Guide

On November 9, 2026, CISA added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. The additions span four very different attack surfaces — GPU orchestration infrastructure, telephony platforms, SSH implementations, and managed file transfer — which tells us attackers are continuing to prioritize internet-facing services and under-monitored edge software as initial access vectors. If any of these products exist in your environment, this is not a "patch next cycle" situation. It is a "validate exposure today" situation.

What Was Added to the KEV Catalog

These vulnerability classes — authentication bypass, code injection, and broken authorization — are consistently among the most exploited categories in the KEV Catalog because they frequently yield direct, unauthenticated remote access with minimal attacker effort. CISA's language is unambiguous: these are frequent attack vectors for malicious cyber actors and pose significant risk to the federal enterprise.

Regulatory Context: BOD 26-04

Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, establishes binding vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. Under the directive's framework, FCEB agencies are required to remediate KEV-listed vulnerabilities within mandated timelines — historically three weeks from KEV publication for most entries, which would place the federal remediation deadline for these four CVEs on or around November 30, 2026.

If you're in the private sector, don't let the federal framing lull you into complacency. KEV inclusion means exploitation is confirmed, weaponized, and underway. The directive's deadlines are a floor for federal agencies, not a benchmark for when attackers will reach you. Industry consistently observes exploitation of KEV entries expanding well beyond government targets within days of catalog publication, as threat actors operationalize working exploits against the broader installed base.

Technical Analysis

CVE-2026-102895 — GPUStack Improper Authentication

GPUStack is an open-source GPU cluster management and orchestration platform used to schedule and serve AI/ML workloads across GPU fleets. An improper authentication vulnerability in this class of product typically means unauthenticated attackers can interact with administrative APIs — registering worker nodes, deploying models, or executing workloads — without valid credentials.

Defender's perspective on the attack chain:

1. Attacker scans for exposed GPUStack management interfaces (default deployments frequently listen on TCP/80 and TCP/443, with API endpoints under /v1/).
2. Unauthenticated requests to the API allow enumeration of cluster resources and, critically, the ability to schedule workloads on GPU nodes.
3. Workload scheduling is effectively remote code execution: an attacker-deployed model container or job can execute arbitrary commands on GPU hosts, which are typically high-value, under-monitored Linux systems with broad internal network access.

AI infrastructure is an increasingly attractive target — GPU compute is expensive, these environments are often deployed rapidly with default configurations, and they sit outside traditional endpoint monitoring coverage in many organizations.

CVE-2026-116779 — SignalWire FreeSWITCH Code Injection

FreeSWITCH is a widely deployed open-source telephony platform handling voice, video, and messaging. Code injection vulnerabilities in FreeSWITCH most commonly affect the event socket interface (mod_event_socket, default TCP/8021) or API command handling, where attacker-controlled input is passed into command execution contexts.

Defender's perspective:

• Exploitation of the Event Socket Library (ESL) interface or command injection through exposed API handlers allows attackers to execute arbitrary system commands in the context of the freeswitch service account.
• Telephony infrastructure is historically under-patched, frequently internet-exposed (SIP on UDP/5060, TLS on TCP/5061), and rarely instrumented with EDR. Compromise enables toll fraud, call interception, and pivoting into the internal network.
• Post-exploitation typically manifests as the freeswitch process spawning child shells or interpreters — a strong, low-noise detection signal.

CVE-2026-123158 — OpenBSD OpenSSH Unexpected Status Code or Return Value

This is a logic-class flaw in OpenSSH on OpenBSD where a function returns an unexpected status code or return value, causing a security-relevant decision (such as an authentication or authorization check) to evaluate incorrectly. Return-value handling flaws in SSH daemons are dangerous precisely because SSH is the internet's front door — a check that silently fails open can convert an authenticated-only code path into an unauthenticated one.

Defender's perspective:

• Exploitation requirements depend on the specific code path, but the KEV listing confirms real-world weaponization against OpenBSD systems running affected OpenSSH builds.
• Observable artifacts include anomalous sshd authentication events: successful logins without corresponding key/password validation entries, authentication successes from sources that previously only generated failures, or session establishment following malformed authentication sequences.
• OpenBSD systems are disproportionately deployed as firewalls, bastion hosts, and edge appliances — exactly the systems whose compromise collapses your perimeter model.

CVE-2026-123218 — IBM Aspera Faspex Incorrect Authorization

IBM Aspera Faspex is a high-speed managed file transfer platform used for exchanging large files, frequently deployed at the perimeter with web-facing portals. Incorrect authorization (broken access control) means authenticated users — or in some configurations unauthenticated requesters — can access files, user data, or administrative functions belonging to other users or roles.

Defender's perspective:

• Managed file transfer platforms have been among the highest-impact breach vectors of the last several years because they exist specifically to hold and move sensitive data. An authorization flaw here is a data exfiltration primitive, not just an access issue.
• Expect attackers to enumerate package/download endpoints, manipulate object identifiers (IDOR-style access), and retrieve packages belonging to other users.
• Watch for bulk download patterns, sequential package ID enumeration, and access to administrative API routes from non-administrative sessions.

Exploitation Status

All four CVEs are confirmed actively exploited — that is the explicit criterion for KEV Catalog inclusion. Treat exploitation as ongoing and assume scanning for these products began before the public listing.

Detection & Response

The detections below target observable post-exploitation and exploitation-attempt behavior for each CVE. Tune thresholds to your baseline, but the child-process and API-anomaly signals here are deliberately high-fidelity.

Sigma Rules

---
title: FreeSWITCH Process Spawning Shell or Interpreter - CVE-2026-116779
id: 3f8a1c42-7b9d-4e5f-a2c1-9d4e6b8f1023
status: experimental
description: Detects the freeswitch process spawning command shells, script interpreters, or download utilities, consistent with post-exploitation activity following code injection in FreeSWITCH (CVE-2026-116779).
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: 'freeswitch'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Custom FreeSWITCH call scripts invoking system commands (rare; validate against change records)
level: high
---
title: GPUStack Unauthenticated API Enumeration or Workload Deployment - CVE-2026-102895
id: 8c2d5e71-4a6b-4f38-b1d9-2e7a5c6f3091
status: experimental
description: Detects suspicious access patterns against GPUStack API endpoints associated with cluster management, worker registration, and workload scheduling, consistent with exploitation of improper authentication (CVE-2026-102895).
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/v1/workers'
      - '/v1/models'
      - '/v1/model-instances'
      - '/v1/clusters'
  selection_status:
    sc-status:
      - 200
      - 201
  condition: selection_uri and selection_status
falsepositives:
  - Legitimate GPUStack UI/API traffic from authorized admin hosts (filter on known management source IPs)
level: medium
---
title: IBM Aspera Faspex Package Enumeration or Authorization Bypass - CVE-2026-123218
id: 5b7e3a19-2c8d-4f6a-9e3b-1d5c8a4f7026
status: experimental
description: Detects high-volume or sequential enumeration of Aspera Faspex package and download endpoints from a single source, consistent with incorrect authorization exploitation and bulk data access (CVE-2026-123218).
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.collection
  - attack.t1530
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/aspera/faspex'
      - '/packages'
      - '/download'
  selection_method:
    cs-method: 'GET'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate user package retrieval (investigate when volume from a single source IP or account exceeds baseline)
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts across web/proxy logs (ingested via CEF/Syslog) for exploitation attempts against GPUStack and Faspex endpoints, and across Syslog for anomalous OpenSSH authentication patterns consistent with CVE-2026-123158. Run it over a 14-day lookback and investigate any hits against sources outside your known management infrastructure.

let lookback = 14d;
let gpustack_paths = dynamic(["/v1/workers", "/v1/models", "/v1/model-instances", "/v1/clusters"]);
let faspex_paths = dynamic(["/aspera/faspex", "/packages", "/download"]);
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has_any (gpustack_paths) or RequestURL has_any (faspex_paths)
    | summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), DistinctURLs=dcount(RequestURL)
      by SourceIP, DestinationHostName, DeviceAction
    | where DistinctURLs > 3 or Hits > 50
    | project-rename TargetProduct=DestinationHostName),
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where Facility == "auth" or ProcessName =~ "sshd"
    | where SyslogMessage has "Accepted"
    | extend AuthMethod = extract(@"Accepted (\S+) for", 1, SyslogMessage)
    | extend SourceHost = extract(@"from ([0-9a-fA-F\.:\-]+)", 1, SyslogMessage)
    | summarize AuthSuccesses=count(), Methods=make_set(AuthMethod), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
      by SourceHost, Computer
    | where AuthSuccesses > 10)
| order by LastSeen desc

A companion hunt for FreeSWITCH post-exploitation via forwarded endpoint telemetry:

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has "freeswitch"
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP, RemoteUrl
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to hunt across Linux endpoints for FreeSWITCH or GPUStack service accounts spawning unexpected child processes — the highest-fidelity post-exploitation signal for CVE-2026-116779 and CVE-2026-102895:

-- Hunt for shells/interpreters spawned by FreeSWITCH or GPUStack services
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
    CommandLine =~ '(?i)(/bin/(ba)?sh|python[0-9.]*|perl|curl |wget |ncat? )'
    AND (
        Username =~ '(?i)freeswitch|gpustack'
        OR Exe =~ '(?i)freeswitch|gpustack'
    )
)

And to quickly scope exposure by identifying listening services matching these products:

-- Identify exposed listeners for FreeSWITCH ESL, SIP, and GPUStack services
SELECT Pid, Name, Path, Laddr.IP AS LocalIP, Laddr.Port AS LocalPort, Status
FROM netstat()
WHERE LocalPort in (8021, 5060, 5061, 80, 443)
  AND Status =~ 'LISTEN'
  AND Name =~ '(?i)freeswitch|gpustack'

Remediation

Immediate Actions (All Organizations)

1. Inventory and validate exposure today. Identify every instance of GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex in your environment — including shadow IT, developer workstations, and cloud-hosted AI infrastructure. Use the VQL listener hunt above plus external attack surface scanning to find internet-facing instances you didn't know you had.
2. Apply vendor updates immediately. Obtain patched versions directly from each vendor's security advisory channels:
   • GPUStack: Apply the fixed release referenced in the project's security advisory (GitHub repository security advisories / release notes) for CVE-2026-102895.
   • SignalWire FreeSWITCH: Upgrade per the SignalWire/FreeSWITCH security advisory for CVE-2026-116779.
   • OpenBSD OpenSSH: Apply the OpenBSD errata/syspatch addressing CVE-2026-123158.
   • IBM Aspera Faspex: Apply the fix pack from IBM's security bulletin for CVE-2026-123218. Verify the exact fixed version numbers against each vendor's official advisory before and after patching — record versions for compliance evidence.
3. If you cannot patch within 24-48 hours, isolate. Remove internet exposure for all four services. Place GPUStack APIs, FreeSWITCH ESL (TCP/8021), and Faspex portals behind VPN or IP allowlists. SIP services that must remain public should be restricted to known carrier/peering addresses.

Compensating Controls and Hardening

GPUStack (CVE-2026-102895):

• Bind the management API to localhost or a management VLAN; never expose it directly to untrusted networks.
• Enforce authentication at a reverse proxy layer (mTLS or SSO front-door) as defense in depth even after patching.

FreeSWITCH (CVE-2026-116779):

• Restrict mod_event_socket to loopback or a dedicated management subnet with strict ACLs and strong passwords rotated now.
• Audit SIP signaling exposure; deploy fail2ban-style rate limiting for registration attempts.

OpenBSD OpenSSH (CVE-2026-123158):

• Run syspatch to apply current errata, then verify with sshd -T and version checks.
• Until patched, reduce exposure: enforce key-only authentication, restrict by source IP via pf rules, and enable verbose auth logging (LogLevel VERBOSE) to capture the anomalies hunted in the KQL above.

IBM Aspera Faspex (CVE-2026-123218):

• Apply IBM's fix pack; review access logs for the enumeration patterns in the Sigma rule above before and after patching (exploitation may predate your fix).
• Audit user entitlements and package access permissions; force credential rotation if any anomalous access is found.

Verification Script

Use the following Bash script on Linux/BSD hosts to inventory affected services, capture installed versions, and flag internet exposure for rapid triage across your fleet (run via your configuration management or EDR live-response tooling):

#!/bin/bash
# KEV 2026-11-09 Exposure Assessment - CVE-2026-102895, CVE-2026-116779, CVE-2026-123158
echo "=== GPUStack presence (CVE-2026-102895) ==="
command -v gpustack && gpustack version 2>/dev/null || echo "gpustack binary not found in PATH"
ss -tlnp 2>/dev/null | grep -Ei 'gpustack' || echo "No gpustack listeners detected"

echo "=== FreeSWITCH presence (CVE-2026-116779) ==="
command -v freeswitch && freeswitch -version 2>/dev/null || echo "freeswitch not found"
ss -tlnp 2>/dev/null | grep -E ':(8021|5060|5061)' || echo "No ESL/SIP listeners detected"

echo "=== OpenSSH version (CVE-2026-123158) ==="
ssh -V 2>&1
sshd -T 2>/dev/null | grep -Ei 'loglevel|passwordauthentication|pubkeyauthentication' | head -5

echo "=== Recent sshd accepted auth events (last 24h) ==="
grep -h 'sshd' /var/log/auth.log /var/log/secure 2>/dev/null | grep 'Accepted' | tail -20

For IBM Aspera Faspex, verify the installed build through the Faspex administrative console (System > About) and confirm it against the fixed version listed in IBM's security bulletin; review /opt/aspera/faspex/log/ access logs for the enumeration patterns described above.

Deadlines and Hunting

• FCEB agencies: Remediate per BOD 26-04 timelines — on or around November 30, 2026 (three weeks from KEV publication). Document completion or formally approved exceptions.
• All other organizations: Treat the federal deadline as your outer bound, not your target. Hunt first, patch second, verify third. Because exploitation is confirmed active, run retro-hunts (30+ days of logs) against the detections in this post before assuming you're clean — patching closes the hole but does not evict an attacker who arrived last month.

If your hunts surface suspicious child processes, anomalous auth events, or unexpected package access, escalate to incident response immediately: isolate the host, preserve memory and logs, and assume lateral movement until proven otherwise. GPU hosts, telephony servers, bastion systems, and file transfer platforms all sit on privileged network real estate — a foothold on any of them is rarely the attacker's final objective.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub