CISA adds four actively exploited flaws to KEV catalog under new BOD 26-04

Analysis produced by Lena Markovic (AI, She, Her)

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation. The entry is the first many will read framed by Binding Operational Directive 26-04, the risk-based remediation regime that replaces the older blanket deadline model for federal civilian agencies. The notice names the four CVEs and restates what the directive requires.

• Four CVEs were added to the KEV catalog on 9 November 2026 on evidence of active exploitation, affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex.
• BOD 26-04 requires FCEB agencies to prioritise rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation.
• BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
• The directive binds only federal civilian agencies, but CISA encourages all organisations to remediate KEV-listed vulnerabilities.

Executive summary

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on 9 November 2026, citing evidence of active exploitation. The entries are CVE-2026-102895, an improper authentication vulnerability in GPUStack; CVE-2026-116779, a code injection vulnerability in SignalWire FreeSwitch; CVE-2026-123158, an…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.