CISA's latest cybersecurity alert highlights an increasingly serious challenge for enterprises: identifying vulnerabilities is no longer enough. Organisations must be able to prioritise and remediate them before attackers exploit them.

On November 9, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming evidence of active exploitation affecting GPUStack, SignalWire FreeSWITCH, OpenSSH and IBM Aspera Faspex.

What makes this alert particularly concerning is the diversity of technologies being targeted. These vulnerabilities affect AI infrastructure management, enterprise communication platforms, remote access services and managed file-transfer systems.

Each of these technologies can play an important role in enterprise operations. A successful compromise may expose sensitive information, enable unauthorised access, disrupt critical services or provide attackers with opportunities for further exploitation.

For enterprises, this raises an important question: Are vulnerability remediation priorities determined primarily by severity ratings, or by evidence that attackers are already exploiting the weaknesses?

Traditional vulnerability management often relies heavily on CVSS scores and scheduled patching cycles. However, a vulnerability with confirmed exploitation may require immediate attention, particularly when it affects internet-facing infrastructure or systems handling sensitive information.

This reinforces the importance of risk-based vulnerability management, continuous asset visibility, intrusion prevention, Zero Trust access and behavioural threat detection.

Organisations must know which systems are exposed, which vulnerabilities affect them and whether suspicious activity has already occurred.

Equally important is recognising that applying a patch does not necessarily eliminate an existing compromise. If attackers have already gained access, organisations must investigate for persistence mechanisms, stolen credentials and unauthorised configuration changes.

Security teams should also restrict unnecessary administrative exposure, enforce least-privilege access and maintain effective network segmentation to limit the consequences of a successful attack.

The fundamental cybersecurity lesson is that vulnerability management must evolve from a routine maintenance activity into a continuous, threat-driven security process.

Because the most dangerous vulnerability is not always the one with the highest severity score. It is the one attackers are already exploiting while the organisation remains exposed.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will co

Source: CISA Adds Four Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 09 Nov 2026.