CISA: OpenSSH, GPUStack, FreeSWITCH flaws exploited

What Happened

CISA on Monday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation against GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex. The Aspera Faspex flaw carries the identifier CVE-2026-123218 and is tracked as a privilege escalation issue.

The KEV listing is significant because CISA only adds flaws with credible evidence of exploitation. For federal civilian agencies, the designation triggers a binding remediation deadline under BOD 22-01. Private-sector defenders typically treat KEV additions as a de facto priority signal, since attackers routinely reverse-engineer the same exploits against unpatched enterprise systems.

The four products span very different parts of the stack: OpenSSH is the backbone of remote administration on Linux and BSD; FreeSWITCH powers VoIP and telephony infrastructure; GPUStack orchestrates GPU and AI inference workloads; and Aspera Faspex handles large-file transfer for media, healthcare, and research organizations. The common thread is that all four are often internet-facing and managed by separate teams, widening the window for exploitation.

Why It Matters

An exploited SSH flaw is not a single-system problem. OpenSSH underpins automation, configuration management, and jump-host access across most enterprise estates. Compromise at that layer can mean lateral movement that bypasses traditional network segmentation.

FreeSWITCH exposure is equally consequential for organizations running contact centers or unified communications, where a foothold can yield toll fraud, call interception, or a pivot into internal networks. GPUStack’s inclusion is a tell: AI infrastructure is now firmly on attacker target lists, and these systems frequently run with weak authentication and broad network reach.

Aspera Faspex has a documented history of exploitation by both ransomware operators and nation-state actors, so CVE-2026-123218 should be treated as an active intrusion vector rather than a theoretical risk.

Technical Details

CVE-2026-123218 is a privilege escalation flaw in Aspera Faspex, meaning a lower-privileged foothold can be elevated to administrative control. For OpenSSH, GPUStack, and FreeSWITCH, CISA has not published granular attack detail in the KEV entry, but exploitation in the wild indicates public or semi-public proof-of-concept code exists. Defenders should collect process telemetry on any host running these services, particularly unexpected child processes spawned by sshd, FreeSWITCH’s freeswitch binary, and GPUStack’s API services. For Faspex, audit for anomalous administrative actions and unexpected package creation.

Immediate Risk

Federal agencies face binding deadlines. Everyone else should assume the exploit code is circulating or will be within days. Prioritize internet-facing OpenSSH and FreeSWITCH installations first, then GPUStack clusters, then Faspex transfer nodes. Check your exposure against the KEV entry and apply vendor patches where available.

Security Insight

The notable pattern here is the KEV list’s shift toward infrastructure plumbing: SSH, telephony, file transfer, and now GPU orchestration. Attackers are targeting the trust layers that security teams assume are stable, not the application front doors that get scanned daily. A useful defensive adaptation is to bring AI and GPU infrastructure under the same asset inventory and patch cadence as your SSH estate, because these systems are being adopted faster than the controls protecting them.

Further Reading

• Aspera Faspex privilege escalation, exploited (CVE-2026-123218)
• Latest Security News
• CVE Advisories
• Data Breach Reports