CISA Adds Four New Actively Exploited Vulnerabilities to KEV Catalog
CISA has added four vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation in the wild. The newly listed issues affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. These vulnerabilities are considered high-risk because they can grant attackers full control of compromised systems. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed flaws on publicly exposed assets. Agencies must also verify whether systems were compromised before applying patches. While the directive applies only to federal agencies, CISA strongly encourages all organizations to adopt similar risk-based vulnerability management practices. Organizations can nominate additional exploited vulnerabilities for inclusion via CISA’s official KEV Nomination Form.
CISA AlertsNov 9, 2026Translated from English