MeridianMeridian

CISA Adds Four New Actively Exploited Vulnerabilities to KEV Catalog

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation in the wild. The newly listed issues affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. These vulnerabilities are considered high-risk because they can grant attackers full control of compromised systems. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed flaws on publicly exposed assets. Agencies must also verify whether systems were compromised before applying patches. While the directive applies only to federal agencies, CISA strongly encourages all organizations to adopt similar risk-based vulnerability management practices. Organizations can nominate additional exploited vulnerabilities for inclusion via CISA’s official KEV Nomination Form.

CISA AlertsTranslated from English

Read at source

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on confirmed evidence of active exploitation by malicious cyber actors.

The additions include CVE-2026-102895 affecting GPUStack (Improper Authentication), CVE-2026-116779 in SignalWire FreeSwitch (Code Injection), CVE-2026-123158 impacting OpenBSD OpenSSH (Unexpected Status Code or Return Value), and CVE-2026-123218 in IBM Aspera Faspex (Incorrect Authorization).

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.

BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Organizations aware of an exploited vulnerability not currently listed in the KEV Catalog can submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISABOD 26-04CVE-2026-102895GPUStackOpenBSD OpenSSHIBM Aspera Faspex
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

N-able Takes N-central Cloud Platform Offline After Researcher Publishes 30+ Zero-Day Exploits
Vulns & Exploits

N-able Takes N-central Cloud Platform Offline After Researcher Publishes 30+ Zero-Day Exploits

N-able has taken its hosted N-central environments offline worldwide and advised on-premises customers to shut down servers following the public disclosure of more than 30 alleged zero-day vulnerabilities by security researcher Sean Bales. The flaws, detailed in a GitHub repository named Able2Shell, include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection, and remote code execution issues affecting N-central Appliance 2026.4.0.31 and likely earlier versions. One critical exploit chain uses an unauthenticated XXE vulnerability to steal sessions, reset passwords, create administrator accounts, and execute commands as the nable user or root. Bales released the details without prior notification to N-able, citing the company's alleged failure to address previous vulnerability reports from five to six months ago. N-able confirmed it is developing a hotfix, stated no evidence of active exploitation has been found, and continues to provide status updates every four hours while keeping hosted services offline.

BleepingComputerNov 9, 2026Translated from English

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems
Vulns & Exploits

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

BleepingComputerNov 9, 2026Translated from English

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server
Vulns & Exploits

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server

Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.

SecurityWeekNov 9, 2026Translated from English