CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on Nov. 9, 2026, based on evidence of active exploitation. The agency said these vulnerability types are commonly used by malicious cyber actors and create serious risks for the federal enterprise.
The four catalog entries are CVE-2026-102895 for GPUStack improper authentication and CVE-2026-116779 for SignalWire FreeSwitch code injection. The remaining entries are CVE-2026-123158 for OpenBSD OpenSSH unexpected status code or return value handling and CVE-2026-123218 for IBM Aspera Faspec incorrect authorization.
Binding Operational Directive 26-04, or Prioritizing Security Updates Based on Risk, directs Federal Civilian Executive Branch agencies on how to manage vulnerabilities. The directive applies only to Federal Civilian Executive Branch agencies.
Under BOD 26-04, federal agencies must quickly remediate high-risk KEV Catalog vulnerabilities on publicly exposed assets that give attackers complete control after exploitation, while delaying action on lower-risk issues. The directive also defines when agencies must check for intruder activity before applying patches. Federal agencies must prioritize patching listed flaws on publicly exposed assets under BOD 26-04.
CISA urges all organizations to use risk-based vulnerability management and to prioritize fixing KEV Catalog flaws. The agency plans to keep adding vulnerabilities to the catalog when they meet the specified criteria.
Organizations can submit unlisted exploited vulnerabilities for possible inclusion through CISA’s KEV Nomination Form. Candidate KEV entries require a CVE ID, proof of exploitation, and clear mitigation guidance.
Join the discussion