CISA adds exploited IBM Aspera Faspex CVE-2026-123218, FreeSWITCH, OpenSSH and GPUStack flaws to KEV; IBM also patches 208 API Connect bugs
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 11/11/2026 12:22; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ securityweek.com ↗ thehackernews.com ↗ securityonline.info ×2 ↗
CISA added four vulnerabilities in IBM Aspera Faspex, SignalWire FreeSWITCH, OpenSSH and GPUStack to its Known Exploited Vulnerabilities (KEV) catalog on 9 November 2026, with a federal remediation deadline of 12 November 2026 (securityonline.info, securityaffairs.com). Exploitation in the wild is reported, with public exploit code available (securityonline.info, securityaffairs.com). The Aspera Faspex flaw is CVE-2026-123218 (CVSS 9.8), an authorization bypass that lets an authorized user craft a message to gain full administrative privileges. The FreeSWITCH flaw is CVE-2026-116779, a code injection issue that allows arbitrary command execution (securityweek.com). Observed activity includes reconnaissance, credential theft and malicious control, with some actors deploying a Python-based C2 agent. Some of the flaws are reportedly used for botnets and cryptocurrency mining (thehackernews.com). The Aspera fix was released alongside IBM's 7 November 2026 disclosure of 208 vulnerabilities in API Connect. Those API Connect flaws are not reported as exploited.
Entenda a falha
A vulnerabilidade
CISA added four exploited flaws to KEV. CVE-2026-102895 (9.8), GPUStack before 2.2.0: a remote unauthenticated attacker who makes requests look local gets admin. CVE-2026-116779 (9.8), FreeSWITCH before 1.11.3: a crafted SIP MESSAGE runs API commands, and depending on configuration OS commands; NIST says any authenticated profile account is enough. CVE-2026-123218 (9.8), Aspera Faspex 5.0.0-5.0.19: an authenticated user sends a crafted message and gets full admin; fixed in 5.0.19 PL1. CVE-2026-123158 SSHole (8.1), OpenSSH before 10.6p2 on musl without PAM: remote login without a password. Separately, IBM fixed 208 API Connect flaws (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2; fixed in 10.0.8.13 and 12.1.1.3), up to 9.9, such as CVE-2026-17402 (authenticated OS command injection). They are not reported as exploited.
Como funciona
In GPUStack, a request reaches get_current_user, which checks whether the source is loopback. A same-host reverse proxy peer or a forged X-GPUStack-Real-IP header can make it look local, so it is promoted to administrator. In FreeSWITCH, an inbound SIP MESSAGE reaches sofia_presence_handle_sip_i_message, which splits the To user at a plus sign and treats the left part as the chat protocol selector. The sender thus picks the api protocol and the text runs as an API command. In OpenSSH on musl without PAM, an overlong password (256 to 1024 characters) makes crypt() return an asterisk string; sshd compares it with the asterisk in a passwordless account's password field, finds a match and accepts the login. In Faspex, a crafted message from an authenticated user bypasses authorization checks.
Por que é vulnerável
GPUStack trusted the apparent source address as proof of identity and auto-granted admin to loopback by default, while proxy peers and client headers could fake that source. FreeSWITCH let an inbound SIP message choose the chat protocol that handles it, exposing the api protocol, and treated the To user as trusted. In OpenSSH, musl's crypt() returns for overlong passwords a value identical to the asterisk marking a locked or passwordless account, and sshd without PAM cannot tell them apart (CWE-394). The GPUStack 2.2.0 fix removes the loopback auto-admin path and hardens client IP handling. The FreeSWITCH fix adds an enable-chat-api-proto switch and a 403 response. For Faspex the articles only say incorrect authorization (CWE-863).
Onde está
GPUStack: get_current_user and the POST /v2/inference-backends/from-yaml endpoint; fix in pull request 5346, commit 53f42a6a553542974396d16a4ff6b12bcbedb48d. FreeSWITCH: function sofia_presence_handle_sip_i_message; fix in pull request 3135, commit 7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86, advisory GHSA-mg63-h38w-8p9p.
Como foi descoberta
GPUStack's advisory (31 July) credits Nikko Enggaliano, Wei Yunzhou, Rui Yang and Haoyu Wang for independent reports, and Ulex Innovative Systems' Javier Sixto for reporting in-the-wild exploitation against a 2.1.1 deployment. SignalWire's advisory (28 October) says FreeSWITCH exploitation was observed, without details. For SSHole, Previdian counts attempts since 6 November, GreyNoise saw its first on 7 November, and watchTowr reports botnet and miner use. Positive Technologies reported the Faspex flaw, according to vulners.com. IBM's advisory does not mention exploitation and SecurityAffairs found no confirmation, though CISA lists it. KEV dates differ: 6 November for OpenSSH per SecurityAffairs, 9 November elsewhere. No attacker is named.
PoC pública
SecurityOnline says public exploit code for the OpenSSH flaw (CVE-2026-123158) is on GitHub, but gives no address. Exploit Intel from PatchThis, cited by the same article, confirms exploits for all four flaws. For GPUStack, attackers have been seen gaining admin and running reverse shells. For API Connect, OffSeq reports no public exploit for at least one flaw. With in-the-wild exploitation of the four KEV flaws, patching is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:37.
Detalhes técnicos
- CVE-2026-123218 affects Aspera Faspex 5.0.0 through 5.0.19. The flaw was reported by Positive Technologies (vulners.com). Securityweek.com describes it as an authorization bypass that gives unauthorized administrative access.
- CVE-2026-116779 in SignalWire FreeSWITCH is a code injection flaw that could lead to complete system compromise (securityweek.com).
- The CVE IDs for the OpenSSH and GPUStack entries are not given in the sources. The sources describe the four KEV flaws as covering improper authentication, code injection, authentication bypass and incorrect authorization (securityaffairs.com). Thehackernews.com says they range from privilege escalation to authentication bypass and code injection.
- API Connect: IBM published CVE records on 7 November 2026 for 208 flaws. Of these, 47 are critical and 94 are high, with CVSS scores up to 9.9. They affect API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. 73 are specific to the 12.1 line (securityonline.info).
- Pre-authentication issues include CVE-2026-17301 (CVSS 9.8, authentication bypass via improper cryptographic signature verification) and CVE-2026-17360 (hard-coded credentials giving full administrative control).
- CVE-2026-17408 and CVE-2026-17340 allow code execution via OS command injection and path traversal. CVE-2026-17313 allows takeover of gateway configuration.
- Authenticated 9.9-rated flaws include CVE-2026-17402 (OS command injection), CVE-2026-17392 (LDAP injection for admin access to other tenants) and CVE-2026-17410 (access to and modification of other tenants' portal data).
- Server-side request forgery is the most common class, with about 40 entries. IBM's bulletins confirm authenticated SSRF, broken object-level authorization and hard-coded cryptographic key issues (ibm.com).
Remediação
- Aspera Faspex: upgrade to 5.0.19 PL1, per IBM's bulletin (ibm.com). Prioritize this because the flaw is in KEV and the federal deadline is 12 November 2026.
- API Connect: apply 10.0.8.13 for the 10.0.8 branch and 12.1.1.3 for the 12.1 branch (ibm.com, bulletins dated 5 November 2026). These products are closed-source and distributed via IBM Fix Central.
- FreeSWITCH, OpenSSH, GPUStack: apply vendor fixes or mitigations. The sources do not name fixed versions for these products.
- Until patching is done, restrict management and gateway interfaces to trusted networks. Limit outbound traffic from API Connect hosts to reduce SSRF exposure. Review tenant and administrative accounts for unexplained changes (securityonline.info). Hunt for signs of the reported Python-based C2 agent, credential theft and cryptomining on exposed hosts (thehackernews.com).
Relatos divergentes
- Exploitation status: the 9 November API Connect and Aspera article said no exploitation in the wild had been confirmed and no public exploit code had been reported (securityonline.info). Later reports say CVE-2026-123218 is actively exploited (securityweek.com) and that CISA added it to KEV on 9 November (securityonline.info, securityaffairs.com). The later reports are more recent and rest on CISA's listing, so they supersede the earlier statement.
- Start of exploitation: thehackernews.com says exploitation has been observed since November 2026. The other sources give no start date.
- Attribution of activity to CVEs: thehackernews.com does not say which vulnerability is tied to the Python-based C2 agent, botnets or cryptomining. No source names a threat actor, so this remains unattributed and unconfirmed.
- Fixed version: the Aspera affected range ends at 5.0.19 and the fix is 5.0.19 PL1 (ibm.com). Check the patch level rather than the base version number alone.
Linha do tempo
-
CISA adds critical vulnerabilities in IBM, SignalWire, OpenSSH, and GPUStack to KEV catalog
ler a análise desta fonte ocultar
The U.S. CISA has updated its KEV catalog by adding four recently exploited vulnerabilities in IBM Aspera Faspex, SignalWire FreeSwitch, OpenSSH, and GPUStack. These flaws have been actively exploited in the wild, with public exploit code available, highlighting the immediate need for mitigation. The vulnerabilities include issues like improper authentication, code injection, authentication bypass, and incorrect authorization, affecting a range of server and network management platforms. The order mandates federal agencies to remediate these flaws by November 12, 2026, underlining the critical threat posed by unpatched systems vulnerable to remote attack.
-
CISA Warns of Exploitation of Critical Vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch
ler a análise desta fonte ocultar
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of recently patched critical vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch. Both flaws, assigned CVE-2026-123218 and CVE-2026-116779 respectively, have been observed in the wild, with attackers exploiting them to gain unauthorized administrative access and execute arbitrary commands. IBM has already released updates to address CVE-2026-123218, urging affected users to patch immediately. The vulnerabilities involve an authorization bypass and a code injection flaw that could lead to a complete system compromise, emphasizing the need for urgent remediation across affected environments.
-
CISA warns of active exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM flaws
ler a análise desta fonte ocultar
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities impacting OpenSSH, GPUStack, SignalWire FreeSwitch, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation since November 2026. Exploitation activities include reconnaissance, credential theft, and malicious control, with some threat actors deploying a Python-based C2 agent. The vulnerabilities range from privilege escalation to authentication bypass and code injection, with some exploited in the wild for botnets and cryptocurrency mining.
-
CISA Adds Exploited Critical Flaws in OpenSSH, FreeSWITCH, IBM Aspera, and GPUStack to KEV Catalog
ler a análise desta fonte ocultar
Threat actors are actively exploiting four critical and high-risk vulnerabilities across OpenSSH, FreeSWITCH, IBM Aspera Faspex, and GPUStack. These flaws allow unauthenticated remote access or command execution, and have been confirmed in the wild with public exploit code available. CISA has added these to the KEV Catalog on November 9, 2026, with a mandatory patch deadline of November 12, 2026. Immediate patching or mitigation measures are essential to prevent compromise of affected systems, which include servers running login, telecom, file transfer, and GPU cluster tools worldwide.
-
IBM patches 208 API Connect vulnerabilities, 47 critical, plus a 9.8 Aspera Faspex authorization bypass
ler a análise desta fonte ocultar
IBM disclosed 208 vulnerabilities in API Connect, with CVE records published on 7 November 2026; 47 are rated critical and 94 high. The flaws affect API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, with CVSS scores up to 9.9, and include unauthenticated authentication bypass, OS command injection, path traversal, hard-coded credentials and cross-tenant access in shared deployments. IBM separately fixed CVE-2026-123218 (CVSS 9.8) in Aspera Faspex 5.0.0 through 5.0.19, where an authorized user can craft a message to gain full administrative privileges. No exploitation in the wild has been confirmed and no public exploit code or attack traffic has been reported. The operational risk is driven by the few pre-authentication flaws and by the exposure of API gateways; most of the 9.9-rated issues require a valid account, which limits them to tenants and insiders in multi-tenant estates.
Technical Details
CVE-2026-17301 (CVSS 9.8) allows an unauthenticated attacker to bypass authentication through improper verification of a cryptographic signature, and CVE-2026-17360 grants full administrative control through hard-coded credentials. CVE-2026-17408 and CVE-2026-17340 allow code execution via OS command injection and path traversal, while CVE-2026-17313 lets an attacker take control of gateway configuration. A second group rated 9.9 requires a valid account: CVE-2026-17402 (OS command injection), CVE-2026-17392 (LDAP injection to gain admin access to other tenants) and CVE-2026-17410 (access and modification of other tenants' portal data). Server-side request forgery is the most common class, with about 40 entries. Most issues affect both branches; 73 are specific to the 12.1 line. IBM's own bulletins confirm the pattern of authenticated SSRF, broken object-level authorization and hard-coded cryptographic key issues, and rate CVE-2026-17410 at 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) (ibm.com). The Aspera Faspex flaw was reported by Positive Technologies (vulners.com).
Fix Details
IBM's security bulletins name the remediated releases: API Connect 10.0.8.13 for the 10.0.8 branch and API Connect v12.1.1.3 for the 12.1 branch (ibm.com, support pages 7295637 and 7295635, dated 5 November 2026). For Aspera Faspex, the fix ships in 5.0.19 PL1 (ibm.com, support page 7295921). No pull request or commit is applicable: API Connect and Aspera Faspex are closed-source products distributed through IBM Fix Central.
Remediation
Apply the fixes in IBM's security bulletins for API Connect (10.0.8.13 / 12.1.1.3) and Aspera Faspex (5.0.19 PL1). Until patched, restrict management and gateway interfaces to trusted networks, limit outbound traffic from API Connect hosts to reduce SSRF exposure, and review tenant and administrative accounts for unexplained changes.