7 new exploited vulns: FreeSWITCH, OpenSSH, GPUStack and IBM Aspera Faspex due Thursday; WordPress overdue

OpenBSD OpenSSH

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

Added 2026-11-09 · CISA due 2026-11-12 · EPSS 16.5%

What it is: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

Why it matters: EPSS estimates a 16.5% chance of exploitation activity in the next 30 days, higher than 97.0% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: This isn't every Linux server. Per the CVE record, it affects sshd before 10.6p2 on Linux when musl libc is used without PAM, with Alpine Linux as the example: for some account setups, any password between 256 and 1024 characters is accepted. Alpine says openssh-server-pam with UsePAM yes is not affected. OpenSSH calls the root cause something outside sshd that is exploitable through sshd.

Fix: Update to OpenSSH 10.6p2 (Nov 5) or your distribution's patched package, then restart sshd. Alpine's fixed packages are listed in its advisory. If you can't update, set PasswordAuthentication no. CISA flags this entry for forensic triage. OpenSSH 10.6p2 release notes · Alpine advisory · NVD

Sources: OpenSSH release notes · Alpine advisory · CISA KEV

SignalWire FreeSwitch

SignalWire FreeSwitch Code Injection Vulnerability

Added 2026-11-09 · CISA due 2026-11-12 · EPSS 2.2%

What it is: SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

Why it matters: EPSS estimates a 2.2% chance of exploitation activity in the next 30 days, higher than 82.5% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: Stock configs are exposed: inbound SIP chat is on by default, and SignalWire says one accepted MESSAGE (any registered account where MESSAGE auth is on, or none at all if the stock passwordless 'default' directory user is still present) lets a peer pick which FreeSWITCH API command runs. Where mod_lua is loaded, inline Lua is a second route. SignalWire says exploitation has been observed in the wild. The fix has been available since FreeSWITCH 1.11.3 (released Aug 28, 2026).

Fix: Upgrade to FreeSWITCH 1.11.3 or later, where a new per-profile enable-chat-api-proto setting is off by default and closes this route. If you can't upgrade yet, set enable-chat=false on every SIP profile that doesn't need inbound chat. SignalWire says auth-messages and disable_system_api_commands alone do not close the path. CISA flags this entry for forensic triage. SignalWire advisory · FreeSWITCH v1.11.3 · NVD

Sources: SignalWire advisory · CISA KEV

WordPress Core

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Added 2026-11-03 · CISA due 2026-11-06 · EPSS 1.2%

What it is: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during...

Why it matters: EPSS estimates a 1.2% chance of exploitation activity in the next 30 days, higher than 68.4% of all scored CVEs. The federal patch deadline passed 4 days ago.

Gridwatch notes: Affects WordPress 4.7 through 7.1.3 (CVE record). During a full-package core upgrade, predictable, web-accessible staging paths can let an unauthenticated attacker run code on the server. The federal deadline was Nov 6. If a site ran a core upgrade while unpatched, check it for unexpected PHP files.

Fix: Update to WordPress 7.1.4 (Oct 28). WordPress says fixes for older branches back to 4.7 are in progress and will ship as they become ready, so sites on older branches should move to 7.1.4. CISA flags this entry for forensic triage. WordPress 7.1.4 · NVD

Sources: WordPress 7.1.4 · CISA KEV

IBM Aspera Faspex

IBM Aspera Faspex Incorrect Authorization Vulnerability

Added 2026-11-09 · CISA due 2026-11-12 · EPSS 0.7%

What it is: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

Why it matters: EPSS estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 53.7% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: Affects Faspex 5.0.0 through 5.0.19 (IBM bulletin, Nov 7). An authenticated user could craft a specific message to bypass authorization and, per IBM, gain full administrative privileges. Added to KEV on Nov 9 with a Thu Nov 12 federal deadline. CISA lists known ransomware campaign use as Unknown.

Fix: Upgrade to IBM Aspera Faspex 5.0.19 PL1 (Fix Pack 1); IBM says to confirm the faspex-core container image shows 5.0.19 (1ce4b13, Fix Pack: 1). Plain 5.0.19 is still affected. IBM lists no workarounds. CISA flags this entry for forensic triage. IBM security bulletin · NVD

Sources: IBM security bulletin · CISA KEV

GPUStack

GPUStack Improper Authentication Vulnerability

Added 2026-11-09 · CISA due 2026-11-12 · EPSS 0.6%

What it is: GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST...

Why it matters: EPSS estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 46.7% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: Before 2.2.0, GPUStack treated loopback requests as the built-in admin by default. Behind a same-host reverse proxy, or with a forged X-GPUStack-Real-IP: 127.0.0.1 header, remote requests count as loopback. The advisory reports exploitation in the wild against a v2.1.1 deployment. After patching, revoke admin API keys you don't recognize and look for custom inference backends you didn't create.

Fix: Upgrade gpustack to 2.2.0 or later. Until then, set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at the proxy, and keep the API off untrusted networks. CISA flags this entry for forensic triage. GPUStack advisory · GPUStack v2.2.0 · NVD

Sources: GPUStack advisory · CISA KEV

Apple Multiple Products

Apple Multiple Products Improper Authentication Vulnerability

Added 2026-11-04 · CISA due 2026-11-18 · EPSS 1.5%

What it is: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

Why it matters: EPSS estimates a 1.5% chance of exploitation activity in the next 30 days, higher than 74.5% of all scored CVEs.

Gridwatch notes: A 2024 WebKit bug that CISA added to KEV on Nov 4, 2026. It lets an attacker who already has arbitrary read/write bypass Pointer Authentication, so it's a chain component, not a standalone entry point. CISA's description says watchOS 10.5 as if that version were vulnerable; 10.5 is the fixed version.

Fix: Update to Safari 17.5, iOS/iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, tvOS 17.5 or watchOS 10.5 (or later). These May 2024 updates fixed this bug. Apple advisory (Safari 17.5) · iOS/iPadOS 17.5 · macOS Sonoma 14.5 · NVD

Sources: Apple security content · CISA KEV

SonicWall SonicOS SSLVPN

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

Added 2026-11-06 · CISA due 2026-11-20 · EPSS 0.5%

What it is: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor...

Why it matters: EPSS estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 45.3% of all scored CVEs.

Gridwatch notes: Needs valid credentials for another authentication method; it is not an unauthenticated bypass. CISA says it may bypass SAML controls, including SAML-enforced MFA.

Uncertain: fixed builds (reported as Gen7 7.3.4-7013+ and Gen8 8.2.3-8015+) come from third-party summaries; SonicWall's advisory page did not render for us, so we have not confirmed them with the vendor.

Fix: Upgrade SonicOS per SonicWall advisory SNWLID-2026-0014. Per SonicWall's CVE record, affected versions are Gen7 7.3.3-7015 and older and Gen8 8.2.2-8015 and older. After upgrading, confirm SSLVPN logins still go through SAML/MFA as intended. SonicWall advisory · NVD

Sources: SonicWall advisory · CISA KEV