On some Linux systems, a password that should never work is enough to walk through the SSH front door. That is why this week's CISA Known Exploited Vulnerabilities (KEV) update deserves immediate attention from defenders, not only U.S. federal agencies.

What happened

On 9 November 2026, the U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to the KEV catalog, citing evidence of active exploitation:

CVE-2026-123158 (SSHole, CVSS 8.1): an authentication bypass in OpenBSD OpenSSH on Linux when musl libc is used and PAM is disabled.

CVE-2026-102895 (CVSS 9.8): improper authentication in GPUStack that can grant unauthenticated administrative access and lead to code execution.

CVE-2026-116779 (CVSS 9.8): a code-injection flaw in SignalWire FreeSWITCH that can disclose credentials, take over calls, and run commands.

CVE-2026-123218 (CVSS 9.8): an incorrect-authorization issue in IBM Aspera Faspex that can allow an authenticated user to obtain full administrative…