CISA says hackers now exploit an OpenSSH login bypass

Published

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are exploiting an OpenSSH login bypass on Linux, one of four flaws it added to its Known Exploited Vulnerabilities (KEV) catalog on 9 November 2026. The other three hit the FreeSWITCH telephony platform, the GPUStack AI cluster manager and IBM's Aspera Faspex file transfer server.

A KEV listing means CISA has evidence of exploitation in the wild. All four entries carry a remediation due date of 12 November, three days after listing, and all four fall under CISA's forensics triage requirements as well as its patching guidance.

Three critical bugs and one OpenSSH flaw

In order of severity, with the CVSS scores recorded at NVD:

CISA does not record any of the four as used in ransomware campaigns; its catalog lists that field as unknown for each.

The OpenSSH bypass is now confirmed in use

CISA's entry describes CVE-2026-123158 only as an unexpected return value flaw in OpenSSH on Linux that could allow authentication bypass. Its references point to the OpenSSH release notes and to Alpine Linux's 5 November notice on an OpenSSH password authentication bypass. That indicates it is the musl-specific login flaw that France's CERT-FR warned about last week, which affects Linux systems built on the musl C library, such as Alpine and many container images, when OpenSSH runs without PAM. The fix is OpenSSH 10.6p2.

A phone switch that takes commands by text message

The FreeSWITCH bug is the most detailed of the four. According to the NVD record, versions before 1.11.3 split the recipient of an inbound SIP chat message on a plus sign and treated the first part as a chat protocol selector. Choosing the "api" protocol let any peer whose message was accepted run FreeSWITCH API commands, including operating system commands, with the daemon's privileges. Inbound chat is on by default in the stock profiles, any authenticated account is enough, and the record says exploitation has been observed. The FreeSWITCH advisory has the detail; the fix is version 1.11.3.

GPUStack trusted anything that looked local

GPUStack, an open-source manager for GPU clusters that serve AI models, treated requests from the loopback address as the built-in administrator by default in versions before 2.2.0, per the NVD record. A remote request could pass as local through a same-host reverse proxy or a client-supplied header, giving unauthenticated admin access, persistent API keys, worker and cloud-provider secrets, and code execution. Exploitation was seen against a 2.1.1 deployment. The GPUStack advisory covers the fix in 2.2.0.

Aspera Faspex users can promote themselves

According to NVD, IBM Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a message that bypasses authorization and grants full administrative privileges (NVD). The IBM security bulletin carries the fixed release and remediation steps.

Patch by 12 November and check for intrusions

Because CISA tied all four to its forensic triage requirements, treat an exposed, unpatched instance as possibly already breached and review its logs before closing the ticket. For earlier additions, see our coverage of the Ivanti VPN bugs CISA flagged last month. The common thread this time is plain: each flaw turns a login check, or the lack of one, into the attacker's way in.

This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.

Read the full analysis on IntelFusions