“A total of 22 exploitation attempts have been recorded from 14 unique IP addresses so far,” Previdian reported — a striking, specific count tied to a single OpenSSH flaw now on CISA’s Known Exploited Vulnerabilities (KEV) list.
Four high-severity CVEs added to CISA’s KEV catalog
On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its KEV catalog, citing evidence of active exploitation. The entries are CVE-2026-123218 in IBM Aspera Faspex (CVSS 9.8); CVE-2026-116779 in SignalWire FreeSwitch (CVSS 9.8); CVE-2026-123158, nicknamed SSHole, in OpenBSD OpenSSH on Linux (CVSS 8.1); and CVE-2026-102895 in GPUStack (CVSS 9.8). Each vulnerability carries high scores and, according to the bulletin, has an available fix: GPUStack in July 2026, FreeSwitch in October 2026, and both OpenSSH and IBM Faspex in November 2026.
SSHole (CVE-2026-123158): measured exploitation, stealthy post‑exploitation steps
CVE-2026-123158 — described as “an unexpected status code or return value” that can allow authentication bypass — has generated the most detailed telemetry cited by researchers. Previdian reported 22 exploitation attempts from 14 unique IP addresses. GreyNoise said the first attempt against its honeypot network occurred on November 7, 2026 at 12:46 a.m. UTC, and that confirmed post‑exploitation activity came from six source IPs representing 18 distinct attack chains.
Observed post‑exploitation behaviors include reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to establish persistence. In at least one incident, actors deployed TAC Agent, described as a Python-based command‑and‑control (C2) agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself. Defused Cyber noted it had “observed a small amount of actors targeting SSHole” but emphasized the activity is not yet widespread.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGPUStack (CVE-2026-102895): earlier advisory and reported in-the-wild exploitation
The GPUStack vulnerability allows improper authentication and, per the KEV entry, could permit unauthenticated administrative access — including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud‑provider secrets, and code execution via POST /v2/inference-backends/from-yaml. The GPUStack Python package maintainers published an advisory on July 31, 2026 that credited Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for reporting the flaw.
The advisory also noted that “active in-the-wild exploitation” was reported by Ulex Innovative Systems' Javier Sixto. GPUStack’s entry on the KEV list remains notable for both its breadth of impact on model and secret management and the earlier public reporting of active exploitation.
SignalWire FreeSwitch (CVE-2026-116779) and IBM Aspera Faspex (CVE-2026-123218)
CVE-2026-116779 in SignalWire FreeSwitch is listed as a code‑injection vulnerability that could lead to configuration and credential disclosure, arbitrary call control, and command execution. That issue was fixed in October 2026. CVE-2026-123218 in IBM Aspera Faspex is an incorrect-authorization vulnerability that could enable an authenticated user to craft messages that bypass authorization and cause privilege escalation; it was fixed in November 2026. The public record cited by CISA does not yet include detailed exploitation telemetry for these two flaws.
What this means for Federal Civilian Executive Branch agencies, security teams, and maintainers
- Federal Civilian Executive Branch (FCEB) agencies: CISA’s advisory sets a remediation expectation — FCEB agencies are recommended to apply available fixes by November 12, 2026. The KEV designation is the agency’s mechanism for prioritizing remediation of vulnerabilities with evidence of active exploitation.
- Security teams and incident responders: The OpenSSH activity shows a pattern of initial reconnaissance followed by attempts to harvest cloud metadata and persistent access via authorized_keys changes; defenders should treat sightings of similar telemetry — metadata service queries, root key reads, and file‑write attempts to SSH configurations — as high priority.
- Open-source and package maintainers: GPUStack’s public advisory credits multiple independent reporters and cites an external researcher for in‑the‑wild exploitation, underscoring the value of coordinated disclosure and timestamped advisories in tracking exploitation timelines.
For now, the record is concrete where reporting exists — counts of attempts against SSHole, descriptions of post‑exploit activity, and a named list of credited reporters for GPUStack — and silent where it is not: “There are currently no public reports on how the other vulnerabilities are being exploited, who is behind them, and the scale of such efforts,” the advisory notes. With CISA’s KEV additions and an FCEB remediation deadline of November 12, 2026, the immediate choice for organizations is clear: apply the published fixes and monitor for the specific post‑exploitation behaviors recorded against SSHole and GPUStack. The open question the current record leaves is straightforward and consequential — beyond the probes and tooling observed so far, who is conducting the campaigns and how broad is their reach?
