US Cyber Agency Says Attackers Are Already Exploiting an OpenSSH Flaw
The U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog on Nov. 9, 2026, citing evidence that all four are being exploited. One of them is in OpenSSH, the software widely used to log in to Linux servers remotely, though it affects only certain configurations.
A place on that list is a narrow statement, and CISA describes it narrowly in its alert: the agency holds evidence of active exploitation, and federal civilian agencies now have to prioritize fixing the flaw. It is not a severity score, and it is not a finding that any particular organization has been broken into.
CISA names the four as:
CVE-2026-102895, a GPUStack improper authentication vulnerability
CVE-2026-116779, a SignalWire FreeSwitch code injection vulnerability
CVE-2026-123158, an OpenBSD OpenSSH unexpected status code or return value vulnerability
CVE-2026-123218, an IBM Aspera Faspex incorrect authorization vulnerability
The catalog entry for the third says the flaw is in OpenSSH on Linux and could allow authentication bypass, meaning a login accepted without valid credentials. The entries for all four carry a remediation due date of Nov. 12, 2026.
That deadline runs on Binding Operational Directive 26-04, which the alert cites. CISA says that the directive requires federal civilian executive branch agencies to prioritize rapid remediation of catalog-listed flaws on publicly exposed assets that grant total control of the asset after exploitation, while deferring lower-risk work, and that it also sets expectations for when an agency has to check whether attackers reached a system before the patch went on.
The directive binds only those agencies. CISA says that it encourages all organizations to adopt risk-based vulnerability management and to prioritize fixing catalog-listed vulnerabilities, and that it will keep adding entries that meet its criteria.
Each catalog entry points at the vendor's own instructions: the OpenSSH release notes and an Alpine Linux advisory for CVE-2026-123158, an IBM support page for the Aspera Faspex flaw, and GitHub security advisories for GPUStack and FreeSwitch. CISA says anything nominated for the catalog needs a CVE identifier, evidence of exploitation and clear mitigation guidance.
