Five Exploited Flaws to Prioritise in November
CISA added five vulnerabilities in GPUStack, FreeSWITCH, IBM Aspera Faspex, Cisco BroadWorks and Openwave Webtop Media Transcoder to its Known Exploited Vulnerabilities catalogue on 9 and 10 November. For the first three, covered US federal agencies have until 12 November to act and must also conduct forensic triage. The BroadWorks and Openwave entries carry a 24 November deadline. Use the dates alongside the exposure of each deployment and the privileges an attacker could gain. CISA catalogue
GPUStack and FreeSWITCH can expose command execution
GPUStack before 2.2.0 can treat a remote request as if it came from the local machine. A reverse proxy on the same host or a forged client IP header can trigger that behaviour and grant administrative access when localhost authentication is disabled. The maintainers report seeing attackers create custom inference backends that opened remote shells. Upgrade to 2.2.0 or later and review new administrator keys, backend definitions and worker activity before returning an exposed system to service. CVE-2026-102895 · GPUStack advisory
An accepted SIP MESSAGE can make affected FreeSWITCH deployments run API commands with the privileges of the service. The maintainers report exploitation in the wild. Upgrade to 1.11.3 or later and check that the option allowing inbound chat to invoke the API stays off on each SIP profile. The project also documents disabling inbound chat where it is unnecessary. Check both internal and external profiles because they may be configured differently. CVE-2026-116779 · FreeSWITCH advisory
Check Faspex at the container level
IBM describes an authorisation bypass that can grant full administrative privileges. Its summary describes a user with access, while its published severity vector lists no privileges required. Review exposed Faspex deployments without relying on the sign-in screen to settle that discrepancy. IBM lists 5.0.0 through 5.0.19 as affected and directs Linux deployments to 5.0.19 PL1. Verify that the running faspex-core image reports build 1ce4b13, Fix Pack 1. CVE-2026-123218 · IBM bulletin
BroadWorks and Webtop have separate exposure paths
Cisco BroadWorks can disclose sensitive files to an unauthenticated remote attacker through the Open Client Interface provisioning service. Cisco lists RI.2026.07 as the first fixed release for the affected server components. Openwave’s Webtop Media Transcoder flaw can expose sensitive information when an authenticated attacker uploads a specially crafted file. Japan Vulnerability Notes reports that the developer observed exploitation and lists releases before 1.1.22.0 as affected. For both products, verify the version across all running instances and retain request or upload logs from before the patch. CVE-2026-20320 · Cisco advisory · CVE-2026-111793 · Japan Vulnerability Notes
Update, 13 November 2026
Cisco clarified that its exploitation notice reflected the CISA listing and that Cisco itself had no direct evidence of active exploitation. CISA’s listing remains the basis for treating the flaw as known exploited. Cisco advisory revision history
