What CISA changed

Both entries carry a CISA remediation due date of November 12, 2026. [1]

CISA marks forensic triage “Yes” for both entries and lists known ransomware campaign use as “Unknown.” [1]

GPUStack: unauthenticated administrative access

GPUStack describes an authentication bypass that can grant unauthenticated administrative access through trust in a loopback source or a client-supplied X-GPUStack-Real-IP value. [2]

The project says the bypass can permit user and model changes, persistent administrator API-key creation, secret disclosure and code execution through the named inference-backend endpoint. [2]

The advisory reports exploitation in the wild against a GPUStack 2.1.1 deployment. [2]

GPUStack rates the issue Critical at CVSS 3.1 score 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. [2]

The affected range is GPUStack below 2.2.0, and version 2.2.0 is the first fixed release named by the advisory. [2]

IBM Aspera Faspex: authorization bypass with a source conflict

IBM says Aspera Faspex 5.0.0 through 5.0.19 can allow an authorized user to craft a message that bypasses user authorization and gains full administrative privileges. [3]

Authentication conflict: IBM’s prose describes an authorized user, while its published CVSS 3.1 vector says PR:N (no privileges required). [3] Treat the prerequisite as unresolved rather than choosing the more alarming interpretation.

IBM rates the Faspex issue Critical at CVSS 3.1 score 9.8. [3]

IBM’s fix is Aspera Faspex 5.0.19 PL1 and instructs administrators to validate the faspex-core container image as 5.0.19, build 1ce4b13, Fix Pack 1. [3]

Vendor-backed action list

1. Check the affected ranges: GPUStack versions below 2.2.0 and Aspera Faspex 5.0.0 through 5.0.19 are affected. [2] [3]
2. Use CISA’s triage references: CISA’s required action for both entries points readers to its Forensics Triage Requirements. [1]
3. Remediate GPUStack: upgrade to GPUStack 2.2.0 or later. [2]
4. Remediate Faspex: apply 5.0.19 PL1 and validate the faspex-core image as 5.0.19, build 1ce4b13, Fix Pack 1. [3]
5. Use GPUStack’s interim workarounds while updating: require authentication for loopback requests with force_auth_localhost=true; prevent the gateway from making external traffic appear as loopback; strip client-supplied X-GPUStack-Real-IP at the edge; and keep the API off untrusted networks. [2]
6. Verify against the vendor targets: GPUStack says to upgrade to 2.2.0 or later; IBM says to validate the faspex-core image as 5.0.19, build 1ce4b13, Fix Pack 1. [2] [3]

What remains unknown

• CISA’s catalog does not identify a ransomware campaign for either entry; its field is “Unknown.” [1]
• A frozen case-insensitive search found no “victim” or “victims” match in the three reviewed primary-source extracts; this is a bounded text-search result, not a universal finding about victim counts. [1] [2] [3]

Sources

1. CISA Known Exploited Vulnerabilities Catalog (accessed November 9, 2026).
2. GPUStack advisory GHSA-gj9m-f8ph-pmhr (accessed November 9, 2026).
3. IBM Security Bulletin 7295921 / IBM CNA record (accessed November 9, 2026).