CISA's 3-Day Deadline: Four Critical Flaws Hit VoIP, File Transfer, SSH and AI Servers

On Monday, the US Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that all four are already being actively exploited in the wild. Unusually, this batch hits four very different but very common pieces of business infrastructure at once: a VoIP/PBX engine, a file-transfer server, a self-hosted AI model server, and the SSH service that underpins remote access to Linux servers worldwide.

Federal US agencies have been given until 12 November 2026 to patch — just three days from the alert. That deadline doesn't apply to Swiss businesses directly, but the underlying message does: if attackers are actively exploiting these flaws against government networks, they are exploiting them against everyone else running the same software too, including Swiss SMEs.

The four flaws, in plain terms

• GPUStack (CVE-2026-102895) — a self-hosted platform many businesses use to run their own AI/LLM models instead of relying on cloud providers. If you've set up an internal AI server for staff to use, check whether it runs GPUStack.
• SignalWire FreeSWITCH (CVE-2026-116779) — an open-source engine that powers a large share of business phone systems (PBX) and VoIP setups. If your office phone system runs on FreeSWITCH, or your IT provider built your call centre on it, this is exploitable right now.
• OpenBSD OpenSSH (CVE-2026-123158) — the remote-access protocol used on practically every Linux server. Security firm GreyNoise recorded the first real-world exploitation attempt against its honeypot network on 7 November at 12:46am — just days before the CISA alert.
• IBM Aspera Faspex (CVE-2026-123218) — a file-transfer server many larger organisations use to move big files securely. This flaw, rated a maximum-severity 9.8, lets an already-authenticated user bypass authorization checks and escalate their own privileges. IBM has released a fix in version 5.0.19 PL1.

What to do today

1. Identify what you actually run. Ask your IT provider or internal team directly: do we have FreeSWITCH behind our phone system, OpenSSH on any Linux server or NAS, an Aspera Faspex file portal, or a self-hosted GPUStack AI server anywhere in the business?
2. Patch or upgrade immediately — don't wait for a scheduled maintenance window. For Aspera Faspex, update to 5.0.19 PL1. For the others, apply the vendor patches referenced in the CISA alert without delay.
3. Check your SSH exposure. If any Linux server is reachable from the internet via SSH, confirm it is patched, restrict access by IP where possible, and review login logs for unfamiliar attempts since 7 November.
4. Don't assume "we're too small to matter." Active exploitation against a CISA honeypot within days of discovery shows attackers are scanning broadly and automatically — company size is irrelevant to an automated scanner.
5. Document what you checked and when. If you ever need to show due diligence to an insurer or a customer, a simple patch log is worth having.

Why this keeps happening

This is the latest in a steady stream of active-exploitation alerts hitting business-critical systems — VPN gateways, NAS boxes, email security appliances, and now phone and file-transfer infrastructure. The pattern is consistent: a flaw is found, exploitation starts within days, and organisations that patch late get hit. Keeping track of which of these actually affects your own IT stack is a full-time job in itself — which is exactly the kind of daily monitoring and patch management that falls through the cracks in busy SMEs without a dedicated security person.

This is the space Flitz.ai will keep watching and reporting on — the threats that matter to real businesses, not just headlines. If you want a second pair of eyes on your network, phone system, or server setup, The Mejlerö Company (behind Flitz.ai) offers a free network analysis and a free one-hour consultation for businesses in Obwalden, Nidwalden, Lucerne and Zurich, alongside ongoing remote and on-site IT support. It's a practical starting point for finding out whether any of this week's flaws apply to you — before someone else finds out first.

Sources: The Hacker News, CISA.gov, IBM Support.