CISA Adds Active Exploitation Flaws in OpenSSH, GPUStack, FreeSwitch, and IBM Aspera to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday officially added four critical security vulnerabilities impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its heavily monitored Known Exploited Vulnerabilities (KEV) catalog. The federal agency’s decision to elevate these specific flaws stems from mounting evidence of active exploitation in the wild, posing significant risks to enterprise networks, government systems, and cloud infrastructure worldwide.

The inclusion of these vulnerabilities highlights a shifting landscape where threat actors rapidly weaponize newly disclosed software flaws to establish persistent access, conduct reconnaissance, and deploy malicious payloads such as command-and-control agents and cryptocurrency miners. Among the newly cataloged items, the OpenBSD OpenSSH vulnerability—frequently referred to in security circles by the moniker "SSHole" and tracked as CVE-2026-123158—has drawn immediate and intense scrutiny from cybersecurity researchers and threat intelligence firms following a wave of targeted exploitation attempts observed across global honeypot networks.

According to telemetry data from security analytics platform Previdian, exploitation attempts targeting the OpenSSH flaw began surfacing rapidly following initial disclosures, with a recorded total of 22 separate exploitation attempts originating from 14 unique IP addresses in the days immediately following the discovery. Similarly, independent tracking by Defused Cyber noted that a small cohort of cybercriminal actors had begun targeting the SSHole vulnerability shortly after its public revelation, though security analysts at the time stressed that the broader wave of exploitation was not yet universally widespread across the entire internet.

Further visibility into the mechanics of these attacks came from GreyNoise, which reported that its global honeypot infrastructure intercepted the first active exploitation attempt against the OpenSSH flaw on November 7, 2026, at precisely 12:46 a.m. UTC. Subsequent analysis by the threat intelligence community confirmed that post-exploitation activity has since been detected across at least six distinct source IP addresses, manifesting as 18 separate, structured attack chains.

Investigators tracking these malicious sequences have observed a sophisticated progression of post-compromise behavior. Once threat actors manage to bypass security controls via the OpenSSH flaw, the attack chains typically involve immediate reconnaissance sweeps, automated queries directed at cloud metadata services to harvest internal infrastructure details, and aggressive attempts to read sensitive system files, including password hashes and root Secure Shell (SSH) keys. Furthermore, attackers have actively tried to modify the system’s authorized_keys file, a classic persistence technique designed to ensure ongoing, unhindered administrative access even if transient system credentials are altered or rotated.

In at least one confirmed intrusion scenario, unknown malicious operators were observed deploying the TAC Agent—a Python-based command-and-control (C2) agent engineered for modular post-exploitation tasks. The TAC Agent is capable of executing arbitrary shell commands, performing deep system reconnaissance, carrying out directory enumeration, facilitating file transfers, and executing internal software updates to maintain operational resilience within compromised environments. Additional threat intelligence providers, including watchTowr, corroborated these findings, reporting that the OpenSSH vulnerability is actively being weaponized by opportunistic threat actors to fuel large-scale botnets and illicit cryptocurrency mining operations.

While the OpenSSH flaw has dominated immediate headlines due to its high-profile nature and rapid weaponization, the KEV catalog update also incorporates vulnerabilities affecting other widely deployed enterprise software components. Among them is a security flaw in the GPUStack Python package, tracked as CVE-2026-102895. The vulnerability was initially disclosed through an official advisory published on July 31, 2026, by the maintainers of GPUStack. In their advisory, project maintainers credited independent security researchers Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for discovering and reporting the issue, while simultaneously noting that active in-the-wild exploitation had been formally observed and reported by Javier Sixto of Ulex Innovative Systems.

In contrast to the extensive public telemetry surrounding the OpenSSH and GPUStack flaws, detailed technical reports regarding the precise exploitation methods, threat actor identities, and overall operational scale associated with the remaining vulnerabilities affecting SignalWire FreeSwitch and IBM Aspera Faspex remain limited. However, their inclusion in the KEV catalog underscores CISA’s assessment that sufficient indicators of active compromise exist to warrant immediate, mandatory defensive action across the federal civilian technological ecosystem.

Under Binding Operational Directive guidelines, Federal Civilian Executive Branch (FCEB) agencies are strongly advised and formally required to apply all necessary software patches, configuration updates, or mitigation strategies to remediate these four vulnerabilities by the fast-approaching deadline of November 12, 2026. Private sector organizations and critical infrastructure operators are similarly urged to consult CISA’s updated KEV catalog and prioritize these specific patches to mitigate the escalating risk of active cyberattacks.