CISA added three more products to its Known Exploited Vulnerabilities (KEV) catalog on Nov. 9: GPUStack, FreeSWITCH and IBM Aspera Faspex. All three carry a CVSS score of 9.8, and a fixed version exists for each. A fourth entry, OpenSSH, was covered earlier on this site.
What happened
CISA’s bulletin lists four CVEs added “based on evidence of active exploitation.” It does not describe affected versions; those come from the vendors. The bulletin also points federal agencies to BOD 26-04. A Nov. 12 federal deadline was reported by eSecurityPlanet, but the CISA bulletin we read does not state one.
| Product | CVE | Affected | Fixed |
|---|---|---|---|
| GPUStack | CVE-2026-102895 | Before 2.2.0 | 2.2.0 |
| FreeSWITCH | CVE-2026-116779 | 1.11.2 and earlier | 1.11.3 |
| IBM Aspera Faspex | CVE-2026-123218 | 5.0.0 to 5.0.19 | 5.0.19 PL1 |
GPUStack. The project’s advisory, published July 31, says versions before 2.2.0 can treat a request as coming from the local machine and promote it to the built-in admin account when the force_auth_localhost setting is off, which is the default. A same-host reverse proxy or a forged X-GPUStack-Real-IP header can trigger this. The advisory says it was exploited against a version 2.1.1 deployment, where attackers created custom backends that ran reverse shells. Note that the advisory itself lists “no known CVE”; the CVE number appears in CISA’s bulletin.
FreeSWITCH. The advisory, published Oct. 28, says an inbound SIP MESSAGE can select an internal “api” chat interface and run FreeSWITCH API commands, leading to operating system command execution with the service’s privileges. Any profile that accepts inbound MESSAGE traffic is exposed, which is the default. The advisory says exploitation has been observed in the wild.
IBM Aspera Faspex. IBM’s bulletin, dated Nov. 7, says an authorized user can craft a message to bypass authorization and gain full administrative privileges (CWE-863). IBM lists no workarounds. The bulletin makes no exploitation statement of its own; the exploitation evidence is CISA’s listing. IBM’s CVSS vector marks no privileges required, while its text describes an authorized user, so the real-world precondition is unclear.
Who is affected
Teams running GPUStack, voice and messaging platforms built on FreeSWITCH, and organizations using Faspex 5 for file transfers. Internet-facing deployments carry the most risk.
What to do
The steps below marked as ours are our analysis; the vendor-specific measures come from the advisories.
- Upgrade GPUStack to 2.2.0 or later. If you cannot yet, set
force_auth_localhost=true, strip any client-suppliedX-GPUStack-Real-IPheader at the edge, and keep the API off untrusted networks. - Upgrade FreeSWITCH to 1.11.3 or later. The advisory says setting
enable-chat=falseon profiles that do not need inbound SIP chat closes the path; enabling message authentication alone does not. - Apply IBM’s Faspex 5.0.19 PL1 fix and confirm the faspex-core container image shows Fix Pack 1, as the bulletin instructs.
- Our analysis: check for new admin accounts or API keys, unexpected processes, and outbound shells on these hosts since at least the advisory dates, because patching does not remove an attacker who is already in.
What we still do not know
Neither CISA nor the vendors have said who is exploiting these flaws, how many organizations were hit, or whether the attacks are linked. The Faspex exploitation details have not been published, and the GPUStack CVE number is not yet reflected in the project’s own advisory.
Sources: CISA KEV bulletin (Nov. 9, 2026); GPUStack advisory (Jul. 31, 2026); FreeSWITCH advisory (Oct. 28, 2026); IBM security bulletin (Nov. 7, 2026); eSecurityPlanet (Nov. 10, 2026).
Leave a Reply