Evidence indicating active exploitation has prompted the United States Cybersecurity and Infrastructure Security Agency (CISA) to include four specific security vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog on Monday. These flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex.
The catalog entry details the following vulnerabilities: CVE-2026-123218, which carries a CVSS score of 9.8, and is described as an incorrect authorization vulnerability.
The inclusion of these vulnerabilities in the KEV catalog signals a critical operational risk, requiring immediate attention from system operators managing these platforms. This action by CISA reflects an ongoing trend where identified software weaknesses are being actively leveraged by malicious actors in the operational environment.
Why it matters
Operators must immediately assess their infrastructure for these specific vulnerabilities, as active exploitation is confirmed. These high-severity flaws in widely used platforms pose a direct threat to system integrity and security posture. Monitoring CISA's KEV catalog is critical for immediate risk mitigation.
