CISA expands KEV with four new listed defects.
The US CISA has added the GPUStack, SignalWire FreeSWITCH, OpenSSH and IBM Aspera Faspex vulnerabilities to its catalog of known exploited vulnerabilities. The entries cover improper authentication, code injection, authentication bypass, and wrong permissions issues. CISA set November 12, 2026 as the amendment deadline for federal agencies.
The set is operationally striking in its breadth: AI infrastructure, VoIP, remote access and file transfer are managed in one update. Three entries are specifically related to the observed exploit, while the IBM Aspera Faspex flaw was listed without public confirmation of exploit nature in the report provided.
Open sources - closed narratives.