Coverage from Security Affairs indicates that the Cybersecurity and Infrastructure Security Agency has added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog.
The Cybersecurity and Infrastructure Security Agency identified flaws in IBM Aspera Faspex, SignalWire FreeSWITCH, OpenSSH and GPUStack. These vulnerabilities include improper authentication, code injection and authorization bypasses, with several carrying a CVSS score of 9.8. The GPUStack flaw allows remote attackers to bypass authentication and gain administrator privileges, while the SignalWire FreeSWITCH issue enables command execution via crafted SIP messages. Additionally, an OpenSSH vulnerability affects systems using the musl C library, allowing authentication bypass. IBM Aspera Faspex 5 is also impacted by an authorization flaw that could grant administrative access to authenticated users. While no specific threat actors have been linked to these campaigns, the agency confirmed that exploitation has been observed in the wild. Under Binding Operational Directive 22-01, federal agencies must remediate these issues by Nov. 12, 2026. Private organizations are also encouraged to review the catalog and update their infrastructure to mitigate potential risks. These vulnerabilities highlight the ongoing need for rigorous patch management across diverse software platforms to prevent unauthorized system access and data exposure.
Source: Security Affairs
