CISA KEV速報 — 2026-11-09に4件追加

CISA（米サイバーセキュリティ・インフラセキュリティ庁）のKnown Exploited Vulnerabilities（KEV）カタログに、2026-11-09付けで4件のCVEが新規追加された。KEVは実際の悪用が確認された脆弱性のみを掲載するリストであり、追加された時点で攻撃者による悪用が現に進行している可能性が高い。

CVE-2026-102895 — GPUStack GPUStack

脆弱性名: GPUStack Improper Authentication Vulnerability

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

CVE-2026-116779 — SignalWire FreeSwitch

脆弱性名: SignalWire FreeSwitch Code Injection Vulnerability

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

CVE-2026-123158 — OpenBSD OpenSSH

脆弱性名: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

CVE-2026-123218 — IBM Aspera Faspex

脆弱性名: IBM Aspera Faspex Incorrect Authorization Vulnerability

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

※本記事はCISA KEVの公開データをもとに機械的に生成している。対応要否は各組織の環境に応じて判断すること。