CISA KEV Addition: GPUStack Authentication Bypass, FreeSWITCH SIP Command Injection, and Aspera Faspex Privilege Bypass

1. Basic Information

• Article Name: CISA adds GPUStack, FreeSWITCH, and IBM Aspera Faspex vulnerabilities to KEV
• Publisher: CISA
• Published Date: 2026-11-09
• Collected Date: 2026-11-10T07:46:16+09:00
• Source: CISA
• Related Sources: GPUStack GHSA, FreeSWITCH GHSA, IBM bulletin, CISA KEV FreeSWITCH, CISA KEV Aspera
• Affected Products & Technologies: GPUStack before 2.2.0, FreeSWITCH before 1.11.3, Aspera Faspex 5.0.0-5.0.19
• Severity: Critical
• Basis for Severity: CISA added three vulnerabilities to KEV following reports of active exploitation, all leading to admin access or command execution, with a remediation deadline set for November 12.

2. Executive Summary

GPUStack allows unauthenticated administrative access through forged loopback headers or a reverse proxy on the same host that makes the connection source appear to be loopback. This access can lead to code execution through the inference backend. FreeSWITCH allows command execution with daemon privileges through the API chat protocol selection in SIP MESSAGE. Aspera Faspex allows authenticated users to elevate privileges to full admin. All three vulnerabilities have been added to CISA KEV.

3. Attack Flow

1. In GPUStack, an attacker accesses the API as a built-in admin using forged headers or a reverse proxy on the same host to make the connection source appear as loopback. When using a reverse proxy, neither header forging nor credentials are required.
2. In FreeSWITCH, an attacker selects the API protocol via SIP MESSAGE and reaches OS commands through the API.
3. In Aspera Faspex, an authenticated user bypasses authorization controls to become a full admin.
4. CISA added all three vulnerabilities to KEV based on evidence of active exploitation.

4. Attacker Positioning and Execution Location

• Remote attacker for GPUStack and FreeSWITCH; authenticated remote user for Aspera Faspex.

5. Victim and Administrator Perspective

Victim Perspective

• Appears as unexpected administrative changes or service disruptions in AI serving, telephony, or file transfer platforms.

Administrator Perspective

• Check for loopback headers and admin API access in GPUStack, SIP MESSAGE and API commands in FreeSWITCH, and privilege changes in Faspex.

6. Success and Failure Conditions

Success Conditions

• GPUStack: Running a vulnerable version where the localhost authentication setting force_auth_localhost remains at the default value of False. Requests may succeed even without direct access to the management port if routed through a reverse proxy on the same host.
• FreeSWITCH: The system is configured to accept SIP MESSAGE requests. Where MESSAGE authentication is required, one account with permission to register on the SIP profile is sufficient. However, if default users without passwords or A1 hashes remain and do not have allow-empty-password=false configured, an attacker account is not even required. Inbound ACLs alone do not prevent this.
• Aspera Faspex: Requires a valid account.

Failure Conditions and Mitigations

• Update to GPUStack 2.2.0, FreeSWITCH 1.11.3, and Faspex 5.0.19 PL1.

7. Impact of Successful Exploitation

• GPUStack: Acquisition of built-in admin rights, secret disclosure, and code execution via the inference backend.
• FreeSWITCH: Command execution with daemon privileges and access to call control functions.
• Aspera Faspex: Elevation to full admin. Command execution and secret disclosure have not been confirmed in public disclosures.

8. Observable Logs

The following items are candidates for investigation based on the product. Check each item if telemetry is collected in the target environment.

• Email: No email-specific vector has been published for these issues.
• Proxy/SWG/DNS: Inference: If logged, check for connections from unknown sources to GPUStack, FreeSWITCH, and Aspera Faspex.
• Endpoint/EDR: Inference: In GPUStack, check for unexpected process generation or reverse shell-like outbound connections if logged. In FreeSWITCH, check for unexpected child processes spawned under the daemon if logged. For Aspera Faspex, specific process observation points have not been published.
• Identity/IdP: Inference: If logged, check for API key creation in GPUStack and privilege changes in Faspex.
• SaaS/Cloud: Inference: If logged, check for management API activity and configuration changes.
• Network: Inference: If logged, check for anomalous requests and subsequent network traffic.

9. Confirmation of Successful Exploitation

Subsequent Compromise Confirmed

• Target: GPUStack (CVE-2026-102895)
• Public Information: The GPUStack advisory reports that reverse shells were executed in real-world environments. CISA also added the vulnerability to KEV based on active exploitation.
• Verification Scope: Observed incidents involving GPUStack version 2.1.1 and KEV listing scope.

Initial Execution Confirmed

• Target: FreeSWITCH (CVE-2026-116779)
• Public Information: The FreeSWITCH advisory explicitly notes active exploitation in the wild, and CISA added it to KEV based on active exploitation. Command execution with daemon privileges is possible.
• Verification Scope: Scope of the FreeSWITCH advisory and KEV listing. Individual victim scopes remain unpublished.

Active Exploitation Confirmed; Specific Success Stage Not Publicly Disclosed

• Target: Aspera Faspex (CVE-2026-123218)
• Public Information: CISA lists this vulnerability in KEV based on evidence of active exploitation. IBM describes an authorization bypass that allows an authenticated user to gain full administrative privileges. The cited sources do not disclose the specific success stage or subsequent activity in individual incidents.
• Verification Scope: Scope of the IBM bulletin and KEV listing.

10. Investigation Playbook

• Trigger: Trigger based on KEV asset matches, admin API keys, SIP commands, and Faspex privilege changes.
• Initial Review: Verify version, exposure, sources, accounts, and the initial time of anomaly. Investigate admin APIs, commands, secret access, and privilege changes during the pre-patch period.
• Endpoint: Preserve process trees, files, memory, and persistence artifacts.
• Identity & Cloud: Review the creation and usage of accounts, tokens, and secrets.
• Subsequent Activity: Check for follow-up commands, data access, and lateral movement.
• Containment: Isolate affected services, apply patches, revoke credentials, and perform a clean rebuild if necessary.
• Classification: Differentiate between scanning, auth bypass/privilege escalation, command execution, and subsequent compromise.

11. Defense and Detection Ideas

• Single Events: Detect forged loopback headers, SIP API commands, and Faspex admin privilege elevation.
• Timeline Correlation: Correlate events sequentially from initial access to privilege acquisition, follow-up commands, and data access.
• Hunting: Review version inventories and hunt for administrative changes, API keys, inference backend activity, and call control activity.
• Log Gaps: Combine asset, account, and network telemetry when public IOCs or detailed logs are absent.
• Priority Controls: Prioritize patching before KEV deadlines, reducing internet exposure, and forwarding administrative operation logs to external systems.

12. Facts, Inference, and Hypothesis

Facts

• CISA added all three vulnerabilities to KEV on November 9 with a remediation deadline of November 12.
• GPUStack can use headers such as X-GPUStack-Real-IP to spoof loopback connections, obtain built-in admin access, create API keys, retrieve secrets, and execute code via the inference backend. Active exploitation was observed in version 2.1.1 and patched in 2.2.0.
• FreeSWITCH allows SIP MESSAGE requests selecting the API chat protocol to reach switch_api_execute, enabling command execution with daemon privileges. This was patched in version 1.11.3.
• Aspera Faspex allows authenticated users to escalate to full admin using crafted messages. This was patched in 5.0.19 PL1 with no workaround available.

Inference

• Because all three products grant high-privilege access across management, communication, and file transfer planes, post-compromise investigations are necessary in addition to patching.

Hypothesis

• No additional hypotheses are noted.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Network-facing handlers in GPUStack and FreeSWITCH were actively exploited.
T1068	Exploitation for Privilege Escalation	medium	The vulnerability allows an authenticated user to escalate to full admin using a crafted message; the specific success stage of exploitation has not been publicly disclosed.

14. Unknowns and Additional Investigation

• Specific threat actors, incident counts, campaign details, IOCs, and ransomware involvement remain unconfirmed.

15. Impact on SOCs and Organizations

AI infrastructure, telephony, and managed file transfer systems are all core business components. Inventory assets by CVE and use the November 9 KEV additions as a trigger for patch prioritization and compromise investigations.

16. Audience-Specific Summary

• For SOCs: For GPUStack and FreeSWITCH, investigate secret access and command execution following exploitation. For Aspera Faspex, investigate privilege changes and subsequent administrative activity; command execution and secret disclosure have not been confirmed in the cited public sources.
• For Administrators: Immediately update to the specified fixed versions and investigate administrative activities prior to patching.
• For Users: Follow instructions regarding service outages and credential resets.