Confirmed 100ExploitedPatch availableFirst seen 9 Nov 2026, 12:00 UTC

CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

Coverage

Headline	Source	Type	Published
CVE-2026-123218 (IBM Aspera Faspex) added to CISA Known Exploited Vulnerabilities	CISA Known Exploited Vulnerabilities	Official	9 Nov 2026, 12:00 UTC
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws	The Hacker News	Security press	10 Nov 2026, 06:31 UTC
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks	SecurityWeek	Security press	10 Nov 2026, 09:42 UTC

Vulnerabilities and remediation

CVE-2026-123218 Patch availableExploited (CISA KEV) CVSS pending · EPSS 0.7%

IBM Aspera Faspex Incorrect Authorization Vulnerability

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for… Due 12 Nov 2026 (US federal deadline)
Vendor solution: IBM strongly recommends addressing the vulnerability now by upgrading: ProductVersionPlatformFix InstructionsIBM Aspera Faspex5.0.19 PL1Linux Please follow the instructions here https://www.ibm.com/docs/en/aspera-faspex/5.0.x . Validate that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1)
Your version: Check if your Aspera Faspex version is affected →
Checked: Vendor record (ibm) checked 58 min ago

CVE-2026-116779 No fix known yetExploited (CISA KEV) CVSS pending · EPSS 2.2%

SignalWire FreeSwitch Code Injection Vulnerability

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for… Due 12 Nov 2026 (US federal deadline)
Your version: Check if your freeswitch version is affected →
Checked: Vendor record (GitHub_M) checked 3 h ago

Fix status, versions and advisories from NVD; required actions from CISA. EPSS is FIRST’s estimate of the chance of exploitation in the next 30 days. Always confirm with the vendor advisory.

Why this score

Confidence	100 · Confirmed
Most trusted source	90
Independent organisations reporting it (3)	+10
Confirmed by an official source or CISA KEV	+10

We link to the original reporting and don’t reproduce it. Read the sources above for the full details.