Weekly Security Brief: OpenSSH, FreeSwitch, GPUStack Exploited

On November 9, 2026, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. They affect SignalWire FreeSwitch, OpenBSD OpenSSH on Linux, and GPUStack. All three carry a US federal remediation deadline of November 12, 2026, three days after they were listed and one day after this brief is published.

CVE	Vendor and product	Weakness	Added	US federal deadline	Known ransomware use
CVE-2026-116779	SignalWire FreeSwitch	Code Injection	2026-11-09	2026-11-12	Unknown
CVE-2026-123158	OpenBSD OpenSSH	Unexpected Status Code or Return Value	2026-11-09	2026-11-12	Unknown
CVE-2026-102895	GPUStack GPUStack	Improper Authentication	2026-11-09	2026-11-12	Unknown

The deadlines are binding only on US federal civilian agencies. For everyone else, they are a practical benchmark: CISA lists a flaw only when it has evidence of real-world exploitation, and a three-day window signals that the agency considers these urgent. For all three entries, CISA currently lists ransomware use as Unknown.

OpenBSD OpenSSH: Authentication Bypass on Linux

CVE-2026-123158 affects OpenSSH running on Linux. CISA describes it as an unexpected status code or return value problem. In plain terms, the software can mishandle a result during login in a way that may let an attacker get past authentication without valid credentials.

This is the entry with the widest reach. OpenSSH is the standard way administrators log in to Linux servers remotely, so any business running Linux machines that accept SSH connections should treat this one as a priority, especially for systems reachable from the internet.

CISA directs agencies to apply mitigations according to vendor instructions, in line with its BOD 26-04 guidance on prioritizing security updates by risk and its “Forensics Triage Requirements.” If no mitigation is available, the agency says to stop using the product. For most administrators, that means applying the update your Linux distribution or the vendor provides, and limiting SSH exposure until you have.

SignalWire FreeSwitch: Code Injection

CVE-2026-116779 is a code injection flaw in SignalWire FreeSwitch. An attacker who exploits it can expose configuration settings and credentials, take control of calls, and run commands on the underlying system.

Organizations that run FreeSwitch for voice services should assume that a compromised server may have leaked stored credentials. After patching, rotating any passwords or keys held in its configuration is a sensible follow-up.

CISA’s required action is the same as for the other entries: apply the vendor’s update or mitigation following BOD 26-04 and the forensics triage requirements, follow the directive’s cloud-service guidance where relevant, or discontinue use if no fix exists.

GPUStack: Unauthenticated Administrative Access

CVE-2026-102895 is an improper authentication flaw in GPUStack. It can give an attacker administrative access without logging in. From there, an attacker can change users and models, create administrator API keys that persist, and read secrets belonging to workers and cloud providers.

The flaw also allows code execution through the POST /v2/inference-backends/from-yaml endpoint. Teams running GPUStack, particularly instances exposed to the internet, should patch first and then review for unfamiliar API keys and accounts, since persistent keys can outlast the fix.

CISA directs users to apply the vendor’s update or mitigation under BOD 26-04, observe the forensics triage requirements, and stop using the product if mitigations are unavailable.

What to do this week

• Inventory Linux servers that accept SSH connections and apply the vendor’s OpenSSH update or mitigation for CVE-2026-123158 first.
• Patch or mitigate any FreeSwitch deployment, then rotate credentials stored in its configuration.
• Update GPUStack, and audit administrator accounts and API keys for anything you did not create.
• Rotate worker and cloud-provider secrets connected to any GPUStack instance that was exposed before patching.
• Where no fix is available, take the affected service offline or block outside access, as CISA advises.

FAQ

– Does the November 12 deadline apply to my business?

No, it is legally binding only on US federal agencies. It is still a useful target, because CISA has confirmed that all three flaws are being exploited.

– Are these flaws linked to ransomware?

Not as far as CISA has confirmed. The agency lists known ransomware use as Unknown for all three, which means it has not established a link, not that one is ruled out.