US CISA Adds Four High-Risk Vulnerabilities to Known Exploited List, Mandates Federal Patching
The US CISA has added four high-risk vulnerabilities, including OpenSSH's 'SSHole', to its KEV list, requiring federal agencies to patch by November 12.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on November 9 that it has added four vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities affect critical infrastructure sectors, including GPUStack for AI model deployment (CVE-2026-102895), the FreeSWITCH software-defined telecom switch (CVE-2026-116779), the OpenSSH remote connection library (CVE-2026-123158, known as "SSHole"), and IBM's Aspera Faspex file transfer platform (CVE-2026-123218).
Under CISA's directive, all federal agencies must complete patching these vulnerabilities by November 12. This tight deadline underscores the significant risk these flaws pose to government information systems if exploited. Among the four, the OpenSSH "SSHole" authentication bypass vulnerability has the broadest impact, while the other three carry a CVSS severity score of 9.8, indicating maximum-level criticality.