CISA Warns Four More Software Flaws Are Being Actively Exploited, Including OpenSSH

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence of active exploitation. The affected products are GPUStack (improper authentication, CVE-2026-102895), SignalWire FreeSwitch (code injection, CVE-2026-116779), OpenBSD OpenSSH (unexpected status code or return value, CVE-2026-123158) and IBM Aspera Faspex (incorrect authorization, CVE-2026-123218).

CISA notes that these types of flaws are a frequent attack vector for malicious cyber actors. Under its Binding Operational Directive 26-04, US federal agencies must prioritise fast fixes for KEV-listed vulnerabilities on publicly exposed assets where exploitation gives an attacker total control. The directive also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to US federal civilian agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise remediation of KEV Catalog vulnerabilities. Australian businesses that run any of the listed products should check their exposure and apply vendor updates.