Verified status as of November 10, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-123158 in OpenBSD OpenSSH is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-09; federal remediation due 2026-11-12). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a patch reference.
- CVE-2026-123218 in IBM Aspera Faspex is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-09; federal remediation due 2026-11-12). NVD rates it 9.8 (CRITICAL) on CVSS v3.1.
- CVE-2026-116779 in SignalWire FreeSwitch is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-09; federal remediation due 2026-11-12). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a patch reference.
- CVE-2026-102895 in Gpustack is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-09; federal remediation due 2026-11-12). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a patch reference.
TL;DR
CISA added four actively exploited vulnerabilities, three of them rated critical, to its Known Exploited Vulnerabilities catalog on November 9, including an OpenSSH authentication bypass and IBM Aspera privilege escalation. Qubole customers' AWS accounts were breached via stolen platform credentials. N-able took its cloud platform offline after 30+ alleged zero-days were publicly disclosed.
Executive Summary
- CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, 2026, including OpenSSH authentication bypass (CVE-2026-123158) and IBM Aspera privilege escalation (CVE-2026-123218), with federal remediation deadline of November 12.
- Attackers exploited Qubole's trusted AWS access credentials to breach multiple customer accounts between October 14–26, stealing stored secrets and data.
- N-able took its N-central cloud platform offline after a researcher publicly disclosed more than 30 alleged zero-day vulnerabilities with working exploits that could enable full system takeover.
- Plex Media Server flaw chain (Plex2Shell) is now being actively exploited against QNAP NAS devices; the vulnerability chain includes four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656).
- Attackers abused Ethersphere's release automation to publish malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 releases that downloaded and executed wallet-stealing code targeting Swarm network users.
Top Threats Today
1. Critical Vulnerabilities Added to CISA KEV Catalog — Four Flaws in Active Exploitation
Severity: CRITICAL Affected: Government
CISA designated four vulnerabilities as known exploited vulnerabilities with federal remediation deadline of November 12, 2026 [1][3]. OpenBSD OpenSSH on Linux contains an authentication bypass vulnerability (CVE-2026-123158) that could allow unauthorized access [1]. IBM Aspera Faspex contains an incorrect authorization flaw (CVE-2026-123218) permitting authenticated users to escalate privileges through a crafted message [3]. SignalWire FreeSwitch contains a code injection vulnerability (CVE-2026-116779) enabling configuration and credential disclosure, arbitrary call control, and command execution [2]. GPUStack contains an improper authentication vulnerability (CVE-2026-102895) allowing unauthenticated administrative access, persistent API-key creation, disclosure of secrets, and code execution [4].
Sources:[1] CISA KEV[2] CISA KEV[3] CISA KEV[4] CISA KEV
Recommended Action
- URGENT: Patch OpenSSH, IBM Aspera Faspex, SignalWire FreeSwitch, and GPUStack on all affected systems before November 12.
- For federal agencies and contractors: follow CISA remediation directive; verify patching completion by deadline.
- Audit logs for unauthorized administrative access on unpatched systems and reset credentials on systems using affected versions.
2. Qubole AWS Credential Compromise Exposes Multiple Customer Accounts
Severity: HIGH Affected: Technology
Attackers breached AWS accounts belonging to multiple Qubole customers between October 14 and October 26, stealing stored secrets and data by exploiting credentials for an AWS account that Qubole's platform uses to access those customer environments [1]. Cloud security firm Wiz disclosed the incident.
Sources:[1] The Hacker News
Recommended Action
- Qubole customers: immediately revoke AWS credentials and rotate all secrets stored in Qubole-accessed accounts.
- Scan CloudTrail logs for unauthorized API calls and resource creation from October 1 onward, as Wiz recommends.
- Assume secrets (database passwords, API keys, encryption keys) stored in affected Qubole accounts have been compromised and rotate them.
3. N-able Cloud Platform Offline Following Public Disclosure of 30+ Zero-Days
Severity: HIGH Affected: Technology
N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits enabling full system takeover [1].
Sources:[1] BleepingComputer
Recommended Action
- N-able N-central customers: keep on-premises systems offline until patched versions are released and validated.
- Review N-able communications and security advisories for patch availability and deployment guidance.
- Audit systems for signs of compromise during the vulnerability window.
4. Plex Media Server Vulnerability Chain (Plex2Shell) Actively Exploited Against QNAP NAS Users
Severity: HIGH Affected: Technology
Threat actors are actively exploiting Plex2Shell, a four-vulnerability chain in Plex Media Server, exploited against users running it on QNAP NAS devices [1]. The exploitation chain is tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 [1].
Sources:[1] SecurityWeek
Recommended Action
- QNAP NAS administrators: update Plex Media Server to the latest patched version immediately.
- Check NAS logs for suspicious Plex application activity and unauthenticated access attempts.
- Isolate QNAP devices on a restricted network segment until patches are applied.
5. Ethersphere Supply-Chain Attack Delivers Wallet-Stealing Malware via bee-js and Swarm Desktop
Severity: HIGH Affected: Finance
Attackers compromised Ethersphere's release automation to publish malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2, both of which download and execute wallet-stealing code targeting Swarm network users [1].
Sources:[1] The Hacker News
Recommended Action
- Swarm Desktop and bee-js users: uninstall versions 13.3.0 and 0.56.2 immediately and downgrade to previous known-good versions.
- Assume any cryptocurrency wallets managed by affected Swarm Desktop versions are compromised; migrate funds to new wallets.
- Review Ethersphere release notes and security advisories for patched versions before reinstalling.
Today’s Action Checklist
- ☐ URGENT: Scan for and patch OpenSSH, IBM Aspera Faspex, SignalWire FreeSwitch, and GPUStack instances before November 12 CISA deadline.
- ☐ URGENT: Qubole customers: rotate all AWS credentials and secrets; review CloudTrail from October 1 onward.
- ☐ URGENT: N-able N-central on-premises customers: power down systems pending patched release.
- ☐ HIGH: Plex Media Server users (including on QNAP NAS): update Plex Media Server; review access logs for exploitation signs.
- ☐ HIGH: Swarm Desktop / bee-js users: uninstall v13.3.0 / v0.56.2; assume wallet compromise and migrate funds.