CISA KEV additions November 9, 2026; federal remediation due November 12, 2026 under Binding Operational Directive 26-04
Deadline Day: GPUStack, FreeSWITCH, OpenSSH and Faspex Fixes Are Due Today, Triage Included
Today is the day the November 9 batch comes due. CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on November 9, each on evidence of active exploitation, and set a federal remediation deadline of today, November 12, with forensic triage required on all four entries and ransomware use recorded as unknown for each. CVE-2026-102895, scored 9.8, is an improper authentication flaw in GPUStack, the open-source GPU cluster manager teams use to run AI inference: a request that looks like loopback traffic, through a same-host reverse proxy or a forged X-GPUStack-Real-IP header, is treated as an administrator session when force_auth_localhost is left at its default. GPUStack advisory says the bypass was observed in the wild against a deployment running version 2.1.1, where attackers created custom inference backends that ran reverse shells. Versions before 2.2.0 are affected and 2.2.0 is the fix, but the complete upgrade target is 2.2.2 or later, because a separate SAML callback bypass, CVE-2026-102894, scored 9.1 and not in the KEV catalog, is only closed in 2.2.2. CVE-2026-116779, also 9.8, is a code injection flaw in SignalWire FreeSWITCH, reachable through crafted SIP MESSAGE requests, affecting versions through 1.11.2 and fixed in 1.11.3; exploitation can expose configuration files and credentials, allow control of calls, and run commands on the server. CVE-2026-123158, scored 8.1, is the OpenSSH flaw known as SSHole: an unexpected status code becomes a password authentication bypass on portable OpenSSH running on musl-based Linux with PAM disabled, the configuration typical of Alpine Linux container images and small systems built with OpenWrt, Buildroot or Yocto; OpenSSH 10.6p2 is the upstream fixed release and distribution packages carry the fix. CVE-2026-123218, scored 9.8, is an incorrect authorization flaw in IBM Aspera Faspex 5, versions 5.0.0 through 5.0.19, fixed in 5.0.19 PL1, where an authenticated user can craft a message that bypasses authorization checks and gains full administrative privileges. CISA has not identified who is exploiting the four flaws or how many organizations have been hit. No extension to today deadline has been published.
Executives
A deadline day is a reporting day. By close of business you should have four written answers, one per product: patched to the named fixed version, mitigated with the product taken off exposed networks, or not present in the estate, each with the triage result attached. The triage half is the part patch dashboards do not show: the directive expects a check for compromise before or alongside the fix, because each of these flaws was already being used. If a team reports only patch percentages, the job is half reported.
CIO / CISO
Close the batch in exposure order and hold the upgrade targets precisely. Internet-facing FreeSWITCH and Faspex first. GPUStack to 2.2.2 or later, not stopping at 2.2.0, so the SAML callback bypass closes in the same motion, then rotate worker credentials and cloud provider secrets the server held and review administrator API keys created before the upgrade. For OpenSSH, inventory by configuration, not by product name: the affected path is musl with PAM disabled, and Alpine systems using the openssh-server-pam package sit outside it. Record a found-or-not-found triage answer per product; that record is what the deadline actually buys.
Engineers
Verify running versions and running processes, not package states. Faspex must read 5.0.19 PL1, FreeSWITCH 1.11.3, GPUStack 2.2.2 or later. Restart the SSH daemon after applying distribution fixes, because a patched library does not protect a daemon still running the old code, and confirm which PAM configuration each image ships. Where an upgrade cannot land today, use the documented GPUStack workarounds, set force_auth_localhost to true, strip client-supplied X-GPUStack-Real-IP headers at the edge, and block the SAML callback path at the proxy, then keep the service off the open internet until the upgrade lands.
Everyone (non-IT)
Most of this batch lives in systems you never see: phone servers, file transfer tools, and the plumbing behind AI services. There is no update for individual staff to install today. The useful habit is the standing one: when your IT team announces an urgent maintenance window for a phone system, a file transfer service, or an internal AI tool this week, take it at face value and plan around it. These deadlines exist because attackers are already using the flaws, not because a calendar page turned.