Lead · Vulnerabilities
Four new KEV entries, and the one that matters is in sshd
CISA added GPUStack, OpenSSH, FreeSwitch and IBM Aspera Faspex to the Known Exploited Vulnerabilities catalogue in a single drop, and the OpenSSH one is being used right now.
The batch landed together: CVE-2026-102895 in GPUStack, an improper authentication flaw that CISA describes as allowing unauthenticated administrative access, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/; CVE-2026-123158 in OpenBSD OpenSSH on Linux, an unexpected status code or return value flaw that allows authentication bypass; CVE-2026-116779 in SignalWire FreeSwitch, code injection permitting configuration and credential disclosure, arbitrary call control and command execution; and CVE-2026-123218 in IBM Aspera Faspex, an incorrect authorization flaw allowing privilege escalation. Separately, CISA flagged a SonicWall SonicOS MFA bypass amid reports it said may have been exploited in real-world attacks.
The EPSS scores on the four sit between 0.00331 and 0.01299, which is the statistical way of saying probably not you. KEV is the other kind of sentence. Two outlets report the OpenSSH flaw, now going by SSHole, is being actively exploited to execute commands, steal credentials and establish persistent access, with the early attempts attributed to botnets and crypto miners and the expectation that better-funded people follow. A forecast and a photograph disagreed this morning, and the photograph wins.
The GPUStack entry is the one I would read twice. It is unauthenticated administrative access to the thing that schedules your model workloads, including the cloud-provider secrets it holds on your behalf; one KEV tracker rates it CVSS 9.8, reachable over a network with no login and no click. We spent three years arguing about whether AI was a security problem and then quietly gave it a control plane with an auth bypass in it. Maureen notes, correctly, that nobody has yet decided whether the GPU cluster is in scope for the quarterly patch report, because when it was procured it was described as research.
Why it mattersPatch order today: sshd on anything internet-facing, then the GPU orchestration layer nobody has written a runbook for, then Faspex and FreeSwitch.