Vulnerability · high
CISA adds IBM, SignalWire FreeSwitch, OpenSSH and GPUStack flaws to KEV catalog
Tier A · Patch today – Before you go home
Who’s exposed: Operators of the named IBM, FreeSwitch, OpenSSH and GPUStack products
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Exploited in the wild
What to do
- Check whether your systems run affected IBM, SignalWire FreeSwitch, OpenSSH or GPUStack versions
The Brief
- The U.S. CISA added flaws in IBM, SignalWire FreeSwitch, OpenSSH and GPUStack to its Known Exploited Vulnerabilities catalog.
- The catalog lists vulnerabilities that sources describe as exploited, so the flaws are already being used in attacks.
Why it matters
Developers and operators running any of these four products may be exposed to flaws that attackers are already exploiting, so they should check whether they run affected versions.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: OpenSSH, IBM enterprise software, FreeSwitch and GPUStack are tools developers and ops teams run. |
| Yes | Core infrastructure | Judgment: OpenSSH is core infrastructure nearly every team runs, and it is among the affected flaws. |
| Yes | Popular tool | Judgment: OpenSSH is a widely used tool, and coreInfra is yes. |
| Yes | Exploited in the wild | Security Affairs: CISA added the IBM, FreeSwitch, OpenSSH and GPUStack flaws to its Known Exploited Vulnerabilities catalog. |
| No | Public exploit | Security Affairs: no source mentions published exploit code or a proof-of-concept. |
| No | Remote, no login | Security Affairs: no source states whether unauthenticated network access is enough. |
| No | Full takeover | Security Affairs: no source describes code execution, root access or account takeover. |
| No | Secrets exposed | Security Affairs: no source reports stolen credentials, keys, configs or customer data. |
| No | Supply chain | Security Affairs: no source reports compromised packages, updates, build pipelines or signing keys. |
| No | No fix yet | Security Affairs: no source says a patch is missing or incomplete. |
Timeline
CISA added IBM, SignalWire FreeSwitch, OpenSSH and GPUStack flaws to its KEV catalog
Security Affairs
U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog
Source
U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog ↗ Security Affairs · 3h ago
First seen · 1 source · Full story page · How tiers are decided