Four Critical CVEs Hit CISA KEV Catalog: GPUStack, FreeSWITCH, OpenSSH, IBM Aspera Faspex Under Active Exploitation

As reported by SecurityAffairs, CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, spanning AI GPU management infrastructure, VoIP platforms, core SSH implementations, and enterprise file transfer systems. The diversity of affected products is notable — and concerning. It signals that threat actors are casting a wide net across both emerging and legacy infrastructure.

Vulnerability Summary

Why This Matters

The inclusion of a GPUStack vulnerability in the KEV catalog is particularly significant. GPUStack manages GPU clusters and AI model deployments — infrastructure that has become high-value target terrain as organizations rush to operationalize AI. An authentication bypass yielding administrator privileges on such a platform could expose proprietary models, training data, and API keys, while also providing a foothold for lateral movement into broader cloud environments. The fact that exploitation was observed against a specific version (2.1.1) suggests targeted reconnaissance against AI infrastructure, not opportunistic scanning.

The FreeSWITCH code injection flaw (CVE-2026-116779) is equally alarming. Telephony platforms have long been soft targets — they often sit outside the purview of standard IT security monitoring, run on legacy OS configurations, and handle call routing with elevated privileges. The ability to execute OS commands through crafted SIP messages means attackers can pivot from VoIP compromise to full network intrusion with minimal effort.

The OpenSSH flaw (CVE-2026-123158) deserves special attention. While it affects a narrower deployment profile — Linux systems using the musl C library without PAM — this configuration is common in embedded systems, containers, and lightweight distributions like Alpine Linux, which underpins countless container images in production environments. SSH is foundational infrastructure; any authentication bypass, even conditionally triggered, demands immediate response.

Who Is Most at Risk

• AI/ML teams running GPUStack for cluster management — especially unpatched 2.x deployments exposed to internal or external networks
• Telecom and contact center operators using FreeSWITCH for SIP-based communications
• Containerized environments using Alpine Linux or other musl-based images with OpenSSH deployed without PAM
• Enterprise organizations using IBM Aspera Faspex for large-scale secure file transfer, common in media, healthcare, and financial sectors

Shield53 Recommendations

Immediate Actions

Detection Guidance

• Monitor GPUStack for new API key creation from unexpected source IPs, especially 127.0.0.1 spoofed headers
• Deploy SIP anomaly detection for FreeSWITCH — flag SIP MESSAGE requests containing API command syntax
• Audit SSH authentication logs on musl-based systems for successful logins that bypass expected authentication flows
• Correlate Aspera Faspex access logs against user role changes and bulk file transfer anomalies

Broader Strategic Guidance

Organizations should treat the KEV catalog as a minimum patching baseline, not a comprehensive security program. The rapid addition of these four diverse CVEs underscores that threat actors are exploiting across the full technology stack — from AI infrastructure to legacy file transfer. Security teams must inventory all externally exposed services, including those managed by specialized teams (telecom, AI/ML, data engineering), and ensure they are included in vulnerability management workflows. The siloization of these systems is often the real vulnerability.