Short answer: CISA warns of active exploitation of security flaws in OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex. Federal Civilian Executive Branch (FCEB) agencies must apply fixes by November 12, 2026.
TL;DR
- CISA added four security flaws to its Known Exploited Vulnerabilities list.
- CVE-2026-102895 allows unauthenticated administrative access.
- CVE-2026-116779 enables command execution and arbitrary call control.
What is CVE-2026-123218?
These vulnerabilities affect OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex. They allow attackers to gain unauthorized access, execute commands, and control calls. CISA warns that these flaws are being actively exploited. Federal Civilian Executive Branch agencies should update their systems by November 12, 2026.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 10 Nov 2026 |
| CVE | CVE-2026-123218 |
| CVSS | 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-863 (incorrect authorization) |
| CISA KEV | Yes, added 2026-11-09; federal due date 2026-11-12 |
| Ransomware use | Unknown (CISA KEV) |
| CVE | CVE-2026-102895 |
| CVSS | 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-287 (improper authentication), CWE-290 (see NVD), CWE-346 (see NVD) |
| CISA KEV | Yes, added 2026-11-09; federal due date 2026-11-12 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | github.com |
| CVE | CVE-2026-116779 |
| CVSS | 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-749 (see NVD), CWE-77 (see NVD), CWE-78 (OS command injection) |
| CISA KEV | Yes, added 2026-11-09; federal due date 2026-11-12 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | github.com |
| Affected product | IBM Aspera Faspex |
| Published in NVD | 2026-11-07 (CVE-2026-123218) |
| Published in NVD | 2026-11-04 (CVE-2026-102895) |
| Published in NVD | 2026-11-05 (CVE-2026-116779) |
How it works
These vulnerabilities allow attackers to gain unauthorized access or control systems. For example, in GPUStack, a request can appear to come from a trusted loopback source, granting unauthenticated admin access. In FreeSWITCH, an inbound SIP MESSAGE can select an API chat proto, leading to command execution.
- Attacker reaches the IBM Aspera Faspex over the internet / network
- No login or account is needed
- Sends crafted input that triggers the incorrect authorization flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-04 | CVE-2026-102895 published in NVD | NVD |
| 2026-11-05 | CVE-2026-116779 published in NVD | NVD |
| 2026-11-07 | CVE-2026-123218 published in NVD | NVD |
| 2026-11-09 | CVE-2026-102895 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-11-09 | CVE-2026-116779 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-11-09 | CVE-2026-123218 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-11-10 | Reported by The Hacker News | The Hacker News |
| 2026-11-10 | This Skillmate explainer published | Skillmate |
| 2026-11-12 | US federal agencies must patch by this date | CISA KEV |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
OpenSSH
shows the installed OpenSSH client version:
ssh -VHow to fix it
- Update IBM Aspera Faspex to the fixed release named in the vendor advisory.
- CVE-2026-123218 is in CISA KEV: treat it as actively exploited and patch first.
- Read the vendor advisory for CVE-2026-102895 and upgrade to the fixed release it lists.
- CVE-2026-102895 is in CISA KEV: treat it as actively exploited and patch first.
- Read the vendor advisory for CVE-2026-116779 and upgrade to the fixed release it lists.
- CVE-2026-116779 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for unauthorized access attempts, unexpected commands, and credential disclosures.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-123218 is a real NVD record scored 9.8 CRITICAL | NVD links no vendor advisory for CVE-2026-123218 yet |
| CISA lists CVE-2026-123218 as exploited in the wild | |
| CVE-2026-102895 is a real NVD record scored 9.8 CRITICAL | |
| CISA lists CVE-2026-102895 as exploited in the wild | |
| CVE-2026-116779 is a real NVD record scored 9.8 CRITICAL | |
| CISA lists CVE-2026-116779 as exploited in the wild | |
| Reported by The Hacker News | |
| Reported by github.com |
Why it matters
These vulnerabilities, especially in widely used tools like OpenSSH and FreeSWITCH, can lead to unauthorized access, data theft, and system control. Companies and users need to update software and implement security measures to protect against these threats.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is the CVSS score for these vulnerabilities?
All four vulnerabilities have a CVSS score of 9.8, indicating they are critical.
How can attackers exploit CVE-2026-116779?
Attackers can use a SIP MESSAGE to run FreeSWITCH API commands, leading to arbitrary call control and command execution.
What should I do if I have one of these vulnerabilities?
Apply the latest patches and updates to affected software to fix the vulnerabilities.
Related Skillmate posts
Sources
- CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws (The Hacker News)
- Primary source / advisory (github.com)
- Primary source / advisory (github.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.