[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXYqwR9l1G6Qli8NvpAhEUqi2bjRVysaAEuBJYqnZO6A":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e4c7d03a-6925-4ca2-950d-a2b2d81ad27e","CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws","cisa-warns-of-active-exploitation-of-openssh-gpustack-freeswitch-and-ibm-flaws-4703b2","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability","CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating they are being actively exploited in the wild. The flaws affect OpenSSH (OpenBSD), GPUStack, SignalWire FreeSwitch, and IBM Aspera Faspex. One of the listed vulnerabilities, CVE-2026-123218, has a critical CVSS score of 9.8 and is described as an incorrect authorization vulnerability.","CISA warns of active exploitation of four vulnerabilities in OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fcisa-warns-of-active-exploitation-of.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjVAsrcYxVs8sJe7IiSD6WkTC4yPv0eLfup7dwcsS0NLcAAgoY__wyC3UFCR90PL2ziKCEW-vMNIEQXES-8uAG-MxuXlyIDdQGeNREm8yFv3tbvsCVXXRyRGT4ORirvcVKP_uD62XHYy9w3x_P0o7XzkguJPwq_1vV2jPxxnZWbhAHHUJ3YJ6HbTlXb0shyphenhyphen\u002Fs1600\u002Fopenssh.png","2026-11-10T06:31:42+00:00","2026-11-10T07:00:21.807401+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"OpenSSH","product",{"name":24,"type":22},"GPUStack",{"name":26,"type":22},"FreeSWITCH",{"name":28,"type":22},"IBM Aspera Faspex",{"name":30,"type":31},"OpenBSD","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-123218","Incorrect authorization vulnerability in IBM Aspera Faspex, GPUStack, SignalWire FreeSwitch, and OpenSSH (OpenBSD) with CVSS 9.8, actively exploited.",[18,21,24],{"controls":57,"vendors":140},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":88,"product_name":109,"url":110,"description":111},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":49,"name":113,"problem":114,"products":115},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":153},"actively-exploited-flaws-in-openssh-gpustack-ibm-demand-immediate-patching","Actively Exploited Flaws in OpenSSH, GPUStack & IBM Demand Immediate Patching","CISA's addition of four vulnerabilities — including a critical 9.8-scored incorrect authorization flaw in CVE-2026-123218 — to its Known Exploited Vulnerabilities catalog confirms that threat actors are actively weaponizing unpatched systems in the wild. The affected products span widely-used infrastructure components including OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex, meaning the attack surface is broad and varied. Organizations that lack disciplined patch cycles or asset inventories may not even know they are running vulnerable versions. This incident underscores that CISA KEV listings are a near-real-time signal that exploitation is occurring now, not theoretically — delayed remediation directly translates to elevated breach risk.",[146,147,148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":154,"PCI DSS Requirement 6":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"OWASP A06:2021 Vulnerable and Outdated Components":157,"CIS Control 7: Continuous Vulnerability Management":158,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":159,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":160},"NIS2 mandates that essential and important entities handle incidents and implement vulnerability management practices — active exploitation of these flaws would trigger mandatory response obligations under this article.","Requirement 6 mandates that organizations develop and maintain secure systems by protecting them against known vulnerabilities through timely patching, directly applicable to the unpatched critical flaws highlighted here.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timescales — a process that would mandate urgent action on CISA KEV-listed vulnerabilities like these.","The exploitation of known, unpatched vulnerabilities in OpenSSH, GPUStack, FreeSWITCH, and IBM Aspera Faspex is a textbook example of the risk posed by running outdated or vulnerable software components.","Regular, automated scanning and time-bound remediation processes would have identified and closed these known-exploited vulnerabilities before attackers could leverage them.","This control requires timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch critical flaws in widely deployed infrastructure components before exploitation occurs.","The critical incorrect authorization vulnerability (CVE-2026-123218, CVSS 9.8) highlights the need for strong access control protections that can limit blast radius even when a patch has not yet been applied."]