On November 9, 2026, CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog affecting OpenSSH, GPUStack, SignalWire FreeSWITCH, and IBM Aspera Faspex. Three of the four vulnerabilities (CVSS 8.1–9.8) have confirmed exploitation: OpenSSH is being targeted in attacks deploying C2 agents, GPUStack is being abused to create reverse shells via administrative access, and FreeSWITCH is being exploited for command execution via SIP messages. U.S. federal agencies have been given a remediation deadline of November 12, 2026. Organizations using these products need to immediately check their versions and apply updates.
Vulnerabilities: technical analysis
CVE-2026-123158 — OpenSSH (SSHole)
The vulnerability CVE-2026-123158, dubbed SSHole, affects OpenSSH before version 10.6p2 on Linux systems that use the musl libc library without PAM (a characteristic example is Alpine Linux). The vulnerability is classified as CWE-394 (improper handling of return values) with a CVSS score of 8.1. Under certain account configurations, any password between 256 and 1024 characters in length allows an attacker to bypass authentication.
We have already analyzed this vulnerability in detail. Since publication, the situation has escalated significantly: according to GreyNoise, the first successful exploitation was recorded on November 7, 2026 at 00:46 UTC. As of November 11, GreyNoise had registered 5 possible exploitation attempts and 31 confirmed post-exploitation sessions on its sensors.
CVE-2026-102895 — GPUStack
The vulnerability CVE-2026-102895 (CVSS 9.8) in GPUStack before version 2.2.0 allows an attacker to obtain unauthenticated administrative access. According to the vendor advisory, if a reverse proxy on the same host or a forged X-GPUStack-Real-IP header makes a request appear to originate from 127.0.0.1, the attacker gains full administrative control: modifying users, models, workers and configuration, creating persistent administrator API keys, exposing secrets, and executing code on worker nodes.
According to the entry in the GitHub Advisory Database, the vulnerability was exploited against a deployment of version 2.1.1, where attackers created custom backends with reverse shells. The fix in version 2.2.0 removes the mechanism for automatically granting administrative access to local requests and tightens the handling of forwarding headers.
CVE-2026-116779 — FreeSWITCH
The vulnerability CVE-2026-116779 (CVSS 9.8) in SignalWire FreeSWITCH versions 1.11.2 and earlier is a code injection via an incoming SIP message (SIP MESSAGE). An attacker can select the FreeSWITCH API chat protocol and execute commands with the privileges of the FreeSWITCH process, including exposing configuration and credentials, controlling calls, and executing arbitrary OS commands. The vendor advisory notes that exploitation has been observed in the wild, but details of the campaign — scope, victims, and attribution — have not been disclosed.
CVE-2026-123218 — IBM Aspera Faspex
The vulnerability CVE-2026-123218 (CVSS 9.8, CWE-863) in IBM Aspera Faspex versions 5.0.0–5.0.19 allows an authenticated user to craft a special message to bypass authorization and perform privilege escalation. IBM recommends updating to version 5.0.19 PL1. Unlike the other three vulnerabilities, for CVE-2026-123218 the available materials do not contain independent confirmations of specific exploitation cases.
SSHole post-exploitation activity
According to GreyNoise, the observed post-exploitation activity following use of CVE-2026-123158 includes:
- Checking whether the system is running in a container
- Requests to cloud provider metadata services (AWS, Azure, Alibaba Cloud)
- Attempts to read root SSH keys and password hashes from
/etc/shadow - Modifying the
authorized_keysfile to maintain access
In one activity cluster, deployment of the TAC Agent was recorded — a Python-based C2 agent capable of executing commands, performing system reconnaissance, transferring files, and updating itself. The agent is associated with the domain tac.vpnla.org. GreyNoise stresses that not all SSHole activity is linked to this cluster.
Prioritization and differences in exploitation prerequisites
The four vulnerabilities differ significantly in their exploitation conditions. IBM Aspera Faspex requires the presence of an authenticated user. FreeSWITCH is vulnerable when incoming SIP traffic is reachable. GPUStack is exploited via a reverse proxy on the same host or header spoofing. SSHole is limited to configurations with musl libc without PAM.
From a prioritization standpoint, immediate attention is warranted for OpenSSH, GPUStack, and FreeSWITCH — for these there are independent or vendor confirmations of exploitation in the wild. For IBM Aspera Faspex, the available material confirms critical severity but does not contain comparable evidence of active attacks.
Recommendations
- OpenSSH: update to version 10.6p2. Check whether musl libc without PAM is used (Alpine Linux and similar distributions). Search for signs of compromise: requests to cloud metadata, reads of
/etc/shadow, modification ofauthorized_keys, connections totac.vpnla.org - GPUStack: update to version 2.2.0 or later. Check for unknown administrator API keys and custom backends
- FreeSWITCH: update to version 1.11.3 or later. Restrict incoming SIP traffic to trusted sources
- IBM Aspera Faspex: update to version 5.0.19 PL1
Indicators of compromise (from GreyNoise data)
IP addresses associated with SSHole exploitation:
183.220.91.15,196.128.138.201,20.255.63.133,20.2.81.241152.175.65.88,202.155.94.33,47.80.65.43,209.248.50.17157.15.77.139,103.140.130.248,79.116.138.30
C2 domain: tac.vpnla.org
Given the extremely tight remediation deadline (November 12, 2026 for federal agencies), organizations should first check for OpenSSH on musl-based systems and for GPUStack and FreeSWITCH exposed to external networks — these three vectors have confirmed exploitation and pose the highest risk of compromise right now.
