Threat video1:00
CVE-2026-102895 GPUStack + 3 KEV Flaws: Detection & IOCs
CISA adds four flaws to KEV, including the sshole OpenSSH bypass; 9 detection rules, 9 IOCs and 7 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for CVE-2026-102895 GPUStack + 3 KEV Flaws: Detection & IOCs →
Chapters
- 0:00The hookCISA adds four exploited flaws to KEV.
- 0:04The storyFour products, four flaws, one catalog.
- 0:10Attack pathGPUStack trusts loopback-looking requests as administrator.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise9 indicators to hunt: 1 domain, 2 URLs and 4 package names, and more.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to lateral movement.
- 0:44Remediation17 remediation steps are listed, 5 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CISA adds four exploited flaws to KEV.
0:05Four products, four flaws, one catalog.
0:07Admin access and code execution.
0:11GPUStack trusts loopback-looking requests as administrator.
0:15Admin access mints keys and reads secrets.
0:18FreeSWITCH allows command injection.
0:20Some OpenSSH builds have an authentication bypass.
0:24Faspex has an authorization bypass.
0:29No threat actor is attributed. Confidence: low.
0:339 indicators to hunt: 1 domain, 2 URLs and 4 package names, and more.
0:397 ATT&CK techniques, from initial access to lateral movement.
0:4417 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.