CISA Confirms Attacks on Four Flaws — Patch by November 12

On Monday, November 9, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog. Three of them score 9.8 out of 10 for severity. All four have confirmed evidence of attacks happening right now.

What Is the KEV Catalog, and Why Does It Matter?

CISA's KEV catalog is not a list of theoretical risks. A flaw only lands on it when CISA has evidence that attackers are already using it in the real world.

That is what makes this announcement different from a routine security update. These are not bugs that might be exploited one day. They are already being exploited, and the fixes are already available. The only question is whether you install them before an attacker finds your system.

The Four Flaws

1. OpenSSH "SSHole" — CVE-2026-123158 (Severity 8.1)

This is the flaw getting the most attention, and for good reason. It affects OpenBSD OpenSSH running on Linux, and it can let an attacker bypass authentication entirely — no password needed — on servers where an account has no password set.

Security researchers recorded 22 exploitation attempts from 14 unique IP addresses starting on November 6, 2026, just days after the flaw became known. The attacks are already happening, and they are expected to grow as more attackers learn about it.

OpenSSH fixed the flaw in November 2026 in version 10.6p2. If your business runs a Linux server that anyone can reach from the internet, check your OpenSSH version first. This is the one to patch today, not tomorrow.

It is also a reminder to give every account a strong password. SSHole only works where an account has no password set, so passwordless accounts are exactly the door this flaw opens.

2. GPUStack — CVE-2026-102895 (Severity 9.8)

GPUStack is a platform for running AI models on your own graphics cards. Its flaw is an authentication failure that lets an attacker with no login at all gain full administrator access.

Once in, an attacker can change users and models, create permanent administrator API keys, read worker and cloud-provider secrets, and run code on the server through a single API request. In plain terms, they own the machine.

The fix has been available since July 2026 in GPUStack version 2.2.0. If you run GPUStack and have not updated since the summer, you are exposed right now. Update to version 2.2.0, and keep the service off the open internet unless it truly needs to be reachable.

3. SignalWire FreeSWITCH — CVE-2026-116779 (Severity 9.8)

FreeSWITCH is open-source software that powers phone systems, including internet phone calls for businesses. This flaw is a code injection bug: an attacker can slip commands into the system and run them.

A successful attack can expose configuration files and login credentials, give the attacker control over calls, and let them run commands on the server. For a small business that runs its own phone system, that means both your calls and your server are at risk.

The fix was released in October 2026. If you use FreeSWITCH, apply the update your vendor published for this flaw.

4. IBM Aspera Faspex — CVE-2026-123218 (Severity 9.8)

Aspera Faspex is IBM's high-speed file transfer product, used to move large files between people and organizations. This flaw is an authorization failure: a logged-in user can craft a specific message that bypasses the system's checks and gains higher privileges than they should have.

The risk is highest for organizations that give outside users or guest accounts access to Faspex, since an attacker only needs a low-level account to start from. IBM fixed the flaw in November 2026 in version 5.0.19 PL1.

While You Are Updating, Update Chrome Too

The same week brought a separate warning for everyone who uses a web browser. On Monday, November 10, 2026, Google released an emergency update for Chrome after researchers found a flaw, tracked as CVE-2026-125350, that was already being exploited in real attacks.

It is the eighth Chrome zero-day exploited in the wild this year. The flaw affects Chrome versions before 157.0.8103.50, and because Chrome's engine powers Microsoft Edge and Opera too, those browsers need the same update.

Updating Chrome takes less than a minute: open the menu, go to Help, then About Google Chrome, and let it check for updates. Then relaunch the browser. Do the same in Edge or Opera if you use them.

What To Do Now

You do not need a security team to handle this. Work through this short checklist:

1. Find out what you run. Check whether your business uses OpenSSH on a Linux server, GPUStack, FreeSWITCH, or IBM Aspera Faspex. Ask your IT provider or web host if you are not sure. Many small businesses have a Linux server they rarely think about.

2. Patch the internet-facing systems first. Anything reachable from the internet goes first, starting with OpenSSH. Then work through the rest.

3. Check for passwordless accounts. On any Linux server, make sure no account is left without a password. Disable or remove accounts nobody uses.

4. Update your browser. Chrome, Edge, and Opera users should install the emergency update and relaunch the browser today.

5. Turn on automatic updates. Wherever you can, switch updates to automatic so the next emergency fix installs itself instead of waiting for someone to notice.

6. If you cannot patch yet, limit exposure. Take the affected service offline or block it from the internet until the fix is installed. CISA's own guidance says to stop using a product if no fix is available, and the same logic applies while you are waiting to patch.

The Bottom Line

Four flaws, four open doors, and attackers are already walking through them. The fixes exist for all four, and the deadline is November 12.

Patching is boring work, and it is easy to put off. But this is the rare case where the warning comes with proof: CISA does not add a flaw to this list unless attacks are already confirmed. Check your systems today, apply the updates, and close the doors before someone else finds them open.