CISA Flags Four Exploited Flaws Across AI, VoIP, SSH and File Transfer

2026-11-10

CISA Flags Four Exploited Flaws Across AI, VoIP, SSH and File Transfer

Editorial illustration of AI GPU racks, VoIP phone, SSH terminal and file transfer equipment illustrating four vulnerabilities CISA confirmed exploited on November 9, 2026

The U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, 2026, citing evidence of attacks already occurring. Affected technologies span AI GPU management, internet telephony, Linux remote administration and enterprise file transfer. Federal civilian agencies face a November 12 remediation deadline for the newly listed flaws, according to CISA’s catalog.

Read CISA’s original November 9 alert naming all four CVEs. Source: Cybersecurity and Infrastructure Security Agency.

Three critical flaws and a conditional OpenSSH bypass

The highest-rated issues carry 9.8 out of 10 CVSS v3.1 severity scores. CVSS measures the characteristics of a vulnerability, not how many systems attackers have compromised. CISA’s addition establishes known exploitation, but does not disclose the global number of victims.

Four vertical bars compare CVSS 3.1 scores: GPUStack 9.8, FreeSWITCH 9.8, affected OpenSSH 8.1, IBM Aspera Faspex 9.8 — *Severity comparison using CISA KEV and vendor or MITRE CVSS v3.1 base scores. Ratings reflect technical severity, not frequency of exploitation. Chart: BitcoinVersus.Tech.*

GPUStack lets network identity override login

CVE-2026-102895 affects GPUStack versions before 2.2.0. In certain reverse-proxy arrangements, software treated a request appearing to originate from the local machine as an authenticated administrator. Attackers could exploit a trusted loopback address or spoofable forwarded-IP metadata to obtain administrator access, create persistent API keys and potentially run code on GPU workers. GPUStack’s advisory records observed exploitation and prescribes version 2.2.0 or later.

Authentication flow diagram showing a remote request via reverse proxy gaining implicit GPUStack administrator privileges prior to version 2.2.0 — *Original trust-boundary diagram from the GPUStack vendor advisory. Credit: BitcoinVersus.Tech.*

The broader lesson is that a proxy’s network address proves little about the identity of a remote user. GPUStack’s fix removes automatic administrator treatment for local-looking connections. Administrators should also audit issued keys, proxy trust settings and worker secrets after an exposed deployment is identified.

FreeSWITCH command execution and OpenSSH edge cases

CVE-2026-116779 affects FreeSWITCH 1.11.2 and older. The SignalWire advisory says an inbound SIP messaging path could reach an API command interface, potentially revealing credentials, altering calls or executing commands. Version 1.11.3 closes the path by default. Where upgrading is delayed, disabling inbound chat on profiles that do not require it is a documented mitigation; requiring message authentication alone is insufficient.

CVE-2026-123158 concerns OpenSSH before 10.6p2 in specific Linux configurations using musl libc without PAM. The password-handling flaw could allow authentication bypass for certain accounts. Red Hat states its own products are not affected because they use glibc and PAM. Earlier BitcoinVersus.Tech OpenSSH coverage explains the platform limitation; the new development is confirmed active exploitation cataloged by CISA.

Aspera privilege escalation raises a separate risk

CVE-2026-123218 affects IBM Aspera Faspex versions 5.0.0 through 5.0.19. IBM says an authenticated user may craft a message that bypasses authorization and obtains administrative privileges. The vendor bulletin identifies 5.0.19 PL1 as the remediation release. Unlike the GPUStack flaw, exploitation of the described Faspex weakness requires an authenticated context.

What operators should prioritize

CISA’s risk-based federal directive ties deadlines to exposure and the prospect of asset takeover, alongside forensic triage where specified. Private operators can apply comparable prioritization while checking which exact software versions and deployment conditions exist. Network exposure, credential access and evidence of prior compromise matter more than a headline severity number alone.

Related BitcoinVersus.Tech investigations cover an exploited SonicWall VPN bypass, GitLab patch priorities and network switch patch validation. Four additions in one day illustrate how multiple independent authentication and authorization failures can converge on the same enterprise infrastructure.

Editor’s Note: Original sources: CISA’s November 9, 2026 announcement and KEV catalog; published advisories from GPUStack, SignalWire, IBM and Red Hat. CVSS scores describe potential severity rather than observed breach counts. Versions, conditions and remediation instructions were checked individually. The featured image is an AI-generated editorial illustration; the severity chart and authentication diagram are original explanatory graphics.

Original BitcoinVersus.Tech 5,000-satoshi donation QR

To donate 5,000 satoshis, scan the QR with a compatible Bitcoin wallet. On mobile, use a wallet’s supported image scanner or display the code on another device. Verify the destination before transferring funds.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.