Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 4 Known Exploited Vulnerabilities to Catalog (November 9, 2026)

Source: CISA KEV Catalog · Updated 2026-11-11

Summary

On November 9, 2026, CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-102895, CVE-2026-123158, CVE-2026-116779, CVE-2026-123218. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-102895: GPUStack Improper Authentication Vulnerability

GPUStack · GPUStack

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

Federal due date
2026-11-12
Ransomware use
Unknown
Added
2026-11-09

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

OpenBSD · OpenSSH

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

Federal due date
2026-11-12
Ransomware use
Unknown
Added
2026-11-09

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Read our explainer · NVD record

CVE-2026-116779: SignalWire FreeSwitch Code Injection Vulnerability

SignalWire · FreeSwitch

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

Federal due date
2026-11-12
Ransomware use
Unknown
Added
2026-11-09

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Read our explainer · NVD record

CVE-2026-123218: IBM Aspera Faspex Incorrect Authorization Vulnerability

IBM · Aspera Faspex

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

Federal due date
2026-11-12
Ransomware use
Unknown
Added
2026-11-09

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

Also added to KEV in November 2026

  • November 10, 2026: CVE-2026-20320, Cisco BroadWorks (Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerabi)
  • November 10, 2026: CVE-2026-125350, Google Chromium (Google Chromium Use-After-Free Vulnerability)
  • November 10, 2026: CVE-2026-124194, Microsoft Office (Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action )
  • November 10, 2026: CVE-2026-116606, Barracuda Networks Barracuda Email Security Gateway (ESG) (Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an A)
  • November 10, 2026: CVE-2026-111793, Openwave Messaging Limited Webtop Media Transcoder (Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer B)
  • November 10, 2026: CVE-2026-111560, Barracuda Networks Multiple Products (Barracuda Networks Multiple Products OS Command Injection Vulnerability)
  • November 6, 2026: CVE-2026-19868, SonicWall SonicOS SSLVPN (SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability)
  • November 4, 2026: CVE-2024-27834, Apple Multiple Products (Apple Multiple Products Improper Authentication Vulnerability)
  • November 3, 2026: CVE-2026-119977, WordPress WordPress Core (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulne)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.