CISA Flags OpenSSH Flaw as Exploited, Deadline November 12

The U.S. cybersecurity agency, CISA, added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Monday (9), which is reserved for flaws with evidence of active exploitation. Among them is CVE-2026-123158, affecting OpenSSH, the most widely used remote access server on Linux. The correction deadline for federal agencies is November 12, three days after the inclusion. For the SonicWall flaw included on November 6, a two-week deadline was given.

The other three entries affect GPUStack, an open-source platform for managing GPU clusters and serving AI models (CVE-2026-102895), FreeSWITCH from SignalWire, used as the backbone of telephone systems and voice platforms (CVE-2026-116779), and IBM Aspera Faspex, a system for transferring large files (CVE-2026-123218). All four have been marked for mandatory forensic triage, meaning CISA not only requests a fix but also verification of previous compromise signs.

The OpenSSH Case

The OpenSSH flaw, nicknamed "*sshole" by researchers, affects sshd prior to version 10.6p2 on Linux systems using the musl library without PAM, the default configuration for Alpine Linux. According to CISA's description, the error lies in handling an unexpected return code and allows authentication bypass. In practice, as per Alpine's warning and specialized coverage, accounts locked with an asterisk in the password field can be accessed using an oversized password.

OpenSSH 10.6p2 was released on November 5. The fix starts rejecting stored hashes that are too short to be valid. Alpine has distributed patched packages across all supported branches, and the provisional recommendation for those who cannot update immediately is to disable password login with PasswordAuthentication no. Distributions based on glibc, such as Red Hat, Ubuntu, and Debian, are not affected, according to the published advisories.

The risk for companies is less about the physical server and more about the container. Alpine is one of the most popular base images in Docker precisely because it is lightweight, and teams embedding sshd in images for debugging or vendor access may have inherited the vulnerable configuration unknowingly. OpenWrt, Buildroot, and Yocto, used in routers and embedded devices, also appear on the lists of exposed systems.

GPU as an Attack Surface

The entry for GPUStack resonates most with corporate AI agendas. CISA's description mentions unauthorized administrative access, with the ability to modify users and models, create persistent admin API keys, expose workers’ and cloud providers’ secrets, and execute code via the POST /v2/inference-backends/from-yaml endpoint. Version 2.2.0 addresses this issue, according to the CVE record and specialized coverage.

An exposed inference orchestration panel provides attackers with the cloud credentials that pay for GPUs. Data teams often deploy this type of tool outside the formal IT inventory, which slows down the response precisely where the cost of abuse, in billed GPU hours, is highest.

In FreeSWITCH, CISA points to code injection leading to configuration and credential leaks, arbitrary call control, and command execution. The fix is in version 1.11.3, according to SignalWire's notice. Carriers and cloud contact center providers using the software as a voice engine need to treat the update as urgent. In Aspera Faspex, the flaw allows an authenticated user to escalate privileges with a forged message; IBM has released its own advisory.

From the U.S. Agency to Other Markets

The November 12 deadline formally applies to the U.S. federal government, but the KEV has become a prioritization reference for security teams in other countries. In the European Union, where NIS2 mandates documented vulnerability management for essential operators, inclusion in the catalog provides a ready argument to justify maintenance windows outside the regular calendar. In Brazil, Resolution CMN 4,893, which imposes cybersecurity policies on financial institutions, and Anatel's regulation for operators (Resolution 740/2020) also demand vulnerability management, and the KEV offers the external benchmark that auditors often request.

This week's combination has a common denominator: three of the four products are open-source components embedded in other products, as CISA notes in the records of OpenSSH, GPUStack, and FreeSWITCH. This shifts the work from the patch team to inventory management. The question the CISO needs to answer by Thursday is not whether the company uses OpenSSH, but in how many Alpine images, vendor appliances, and GPU clusters assembled by business units it is running without anyone recording it.