SSHole

CISA Adds Four Actively Exploited Flaws in OpenSSH, GPUStack, FreeSwitch and IBM Aspera Faspex to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added four high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH on Linux, and IBM Aspera Faspex, with CVSS scores ranging from 8.1 to 9.8. Exploitation of the OpenSSH flaw, tracked as CVE-2026-123158 and nicknamed SSHole, began on November 6, 2026, with at least 22 attempts recorded from 14 unique IP addresses. Post-exploitation activity includes reconnaissance, cloud metadata queries, password hash theft, and deployment of the Python-based TAC Agent command-and-control framework. Federal Civilian Executive Branch agencies have until November 12, 2026 to apply available patches. The remaining three vulnerabilities also show signs of real-world abuse, though public details on attackers and scale remain limited.