On Monday, 9 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its catalog of flaws that attackers are known to exploit. Two of them sit right on the routes that engineering companies use to move large files: an authorization bypass in IBM Aspera Faspex, the large-file transfer server, and an authentication bypass in OpenSSH nicknamed SSHole, which affects some Linux systems that offer SSH and SFTP logins. Both have fixes, and US federal agencies were told to apply them by today, 12 November.
Neither flaw is in Autodesk Inventor or Vault. But design data rarely stays inside Inventor. Assemblies, drawings, STEP exports and RFQ packages are often too big for email, so companies send them through file transfer servers, SFTP drop boxes and small Linux machines that someone set up years ago and nobody has touched since. Those systems hold copies of customer models and supplier drawings, and they face the internet by design.
This article explains what is confirmed about the two flaws, which systems in a typical Inventor environment might be affected, and what CAD managers and IT people should check this week. Where facts are not yet public, such as who is exploiting the Faspex flaw, we say so.
TL;DR: IBM Aspera Faspex 5.0.0 to 5.0.19 has a critical authorization bypass (CVE-2026-123218, CVSS 9.8) that can give full administrator rights; the fix is 5.0.19 PL1 and there is no workaround. SSHole (CVE-2026-123158, CVSS 8.1) lets attackers log in to OpenSSH on some Linux systems that use the musl C library without PAM, such as Alpine Linux, when password logins are allowed; the fix is OpenSSH 10.6p2 or your distribution's update. Both are listed by CISA as exploited.
Find every file transfer server and SSH login that faces the internet, patch Faspex, update or switch off password logins on musl-based Linux, check for unknown SSH keys and admin accounts, and clean old CAD packages off transfer servers.
What did CISA add on 9 November?
CISA's alert lists four entries: an improper authentication flaw in GPUStack (CVE-2026-102895), a code injection flaw in SignalWire FreeSWITCH (CVE-2026-116779), the OpenSSH flaw (CVE-2026-123158) and the IBM Aspera Faspex flaw (CVE-2026-123218). A listing in the Known Exploited Vulnerabilities catalog means CISA has evidence of exploitation; it does not say how many organisations were hit.
For US federal civilian agencies, the deadline to fix these four is 12 November 2026. Private companies are not bound by that date, but the catalog is one of the best free signals of what attackers are using right now. When a file transfer product shows up there, it deserves attention from anyone who sends design data through it.
What is the IBM Aspera Faspex flaw?
IBM Aspera Faspex is a server that lets people send large files and packages to colleagues, customers and suppliers through a web interface, using IBM's fast transfer technology. Companies use it where normal sharing tools hit size or speed limits, which is exactly the situation of a manufacturer sending a full Inventor assembly with its drawings and exports.
According to IBM's security bulletin, "IBM Aspera Faspex 5 could allow an authorized user to craft a specific message to bypass user authorization" and gain full administrative privileges. IBM rates it 9.8 out of 10. The affected versions are 5.0.0 through 5.0.19. The fix is version 5.0.19 PL1 on Linux, applied by updating the container images; IBM says administrators should confirm that the faspex-core image shows 5.0.19 with Fix Pack 1. IBM lists no workarounds.
One detail is unclear. The description talks about an authorized user, but the CVSS vector IBM published says no privileges are required. Security reporters have pointed out the gap, and IBM's bulletin does not explain it. Until it does, the safe reading is that an attacker may not need a valid account at all. CISA's listing confirms exploitation, but no public report yet describes the attacks, the attackers or the victims.
Faspex has been here before. In 2023, CISA listed an older Faspex flaw, CVE-2022-47986, as exploited, and security researchers reported that ransomware groups, including IceFire, used it against Linux servers. A file transfer server is attractive because it collects exactly the files a company considered too valuable or too big to send any other way.
What is SSHole, and which systems does it affect?
SSHole is the nickname of CVE-2026-123158, a password authentication bypass in OpenSSH, the SSH server that runs on most Linux machines and also provides SFTP. The OpenSSH team fixed it in Portable OpenSSH 10.6p2, released on 5 November 2026. Its release notes say the bug affects some Linux systems built and run with PAM support disabled, and that the team considers the root cause to be outside OpenSSH itself. The flaw was reported by Özgün Kültekin of Wakefield.
The conditions matter, because most Linux servers are not affected. The bug hits systems that use the musl C library instead of the more common glibc, and that run OpenSSH without PAM. Alpine Linux, a small distribution popular for containers, cloud images and lightweight appliances, ships its default SSH server that way. According to runZero's analysis, an attack also needs password logins to be allowed, which is the default, and another local account with a regular password hash. With a very long password, an attacker can then get in to accounts that should not accept a password at all.
Exploitation started fast. BleepingComputer reports that exploit code appeared about four hours after the fix, and that the threat intelligence firm GreyNoise recorded the first successful attack on 7 November, about 40 hours after the release. GreyNoise saw attackers explore systems and containers, query cloud metadata services, try to read password hashes and root SSH keys, and add their own keys for persistence. In one case an attacker got root and installed a Python remote-control tool. Other researchers saw SSHole used for botnets and cryptomining.
Where could these flaws touch an Inventor environment?
Inventor and Vault run on Windows, so neither flaw affects the CAD workstations or the Vault server directly. The exposure lies in the systems around them. The table below lists the usual places where Inventor data travels or waits, and how to tell whether each one is in scope.
Two warnings. First, an inventory usually finds more transfer routes than anyone expected: a Faspex server set up for one big customer, an SFTP box for a supplier portal, a test container that kept its public IP. Second, the risk is not only theft. An attacker with admin rights on a transfer server can also swap files, which means a supplier could receive a manipulated drawing that looks like it came from you.
Our earlier articles show why these quiet systems matter. The Clop campaign against PLM servers ended with engineering drawings published online, and the backup tool attacks showed how a trusted IT tool can become the way in. This week's Node-RED attacks on industrial gateways followed the same pattern: a small Linux system that faces the network, with weak or missing logins.
Transfer servers move copies. Proof stays with you.
BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and gives you a certificate of ownership, straight from Inventor.
👉 See how BORIS for Autodesk Inventor works
What should Inventor teams do now?
- List every transfer route. Write down each Faspex server, SFTP box, file drop and cloud share that sends or receives Inventor data, who runs it and whether it faces the internet.
- Patch Faspex. Upgrade IBM Aspera Faspex 5.0.0 to 5.0.19 to 5.0.19 PL1, then confirm that the faspex-core image shows 5.0.19 with Fix Pack 1. There is no workaround, so limit internet access to the web interface until the update is in.
- Update OpenSSH. On Alpine and other musl-based systems, install your distribution's fixed openssh package or OpenSSH 10.6p2 or later, including inside container images.
- Switch off SSH passwords. Set PasswordAuthentication to no and use keys wherever you can; on builds that support PAM, run with PAM enabled.
- Look for intruders. Check for unknown admin accounts on Faspex, unexpected password logins, new keys in authorized_keys files and unfamiliar startup services on Linux boxes.
- Clean up old packages. Delete delivered CAD packages from transfer servers after a set time, so a breach exposes days of data, not years.
- Tell suppliers. If customers or suppliers send you files through their own transfer servers, ask whether they are affected and patched.
- Keep dated proof. Register key design files with BORIS before you send them, so you can show which version you created and when if a copy ever turns up elsewhere.
How should you send Inventor files to suppliers after this?
The lesson is not to stop using transfer servers. Large assemblies have to travel somehow, and a well-run Faspex or SFTP server is still better than random consumer file sharing. The lesson is to send less, keep it for less time and know exactly where it went.
Start with what you send. Our guides on how to send partial CAD files safely and how to sanitize CAD files before sharing explain how to share only what a supplier needs, for example a simplified STEP or a Shrinkwrap part instead of the full assembly with all its iLogic rules and parameters. Our overview of Inventor file types helps decide which file belongs in a package. For the process side, see how to share CAD files securely with contractors and the risks of sending CAD files to factories.
Then keep a record. A simple log of which package went to which supplier, from which system, on which date, makes any later investigation much faster. Our article on tracking who accesses your CAD files covers the tools. And if a supplier relationship ever ends badly, the record of what you shared matters as much as the contract, as the SS&C v. Arcesium ruling on partner trade secrets showed.
Is this connected to the other patches this month?
Yes, in the sense that November is a heavy month. A day later, on 10 November, CISA also listed the exploited Outlook flaw that we covered in our article on the November Outlook zero-day, which leaks Windows logins from one opened file. A stolen Windows login and an exposed transfer server are two halves of the same problem: both give an outsider a way to collect your design files without ever touching Inventor.
The practical order for most Inventor teams this week is: Office and Windows updates on workstations, then internet-facing systems such as Faspex, SFTP and VPN, then internal servers. Our guide to CAD file protection with Vault, encryption and proof of ownership explains how these layers fit together.
The bigger picture
This week's news on our sister sites shows how much depends on the systems around the CAD tool.
- PLM under pressure. On CADChain, PTC's fourth critical Windchill and FlexPLM vulnerability of 2026 shows how often the servers that store engineering data need emergency patches.
- Planned downtime. BORIS for SOLIDWORKS explains the 3DEXPERIENCE platform upgrade to R2027x on 21 and 22 November, and how to keep working when the cloud platform is offline.
- Sharing assets. Blended BORIS covers the Blender 5.3 release, with new project folders and remote asset libraries that change how artists share files.
Conclusion
The two flaws CISA flagged on 9 November are not Inventor bugs, but they sit on the routes Inventor files take when they leave the office. IBM Aspera Faspex 5.0.0 to 5.0.19 needs the 5.0.19 PL1 update now, because the flaw can give full admin rights and there is no workaround. OpenSSH on musl-based Linux without PAM, such as Alpine, needs the fixed package or password logins switched off, because attackers began using SSHole within two days of the fix.
Beyond the patches, the best defence is boring: know every transfer route, send only what partners need, delete packages after delivery and keep a record of what went where. And because files that leave the building can be copied, keep dated proof of your designs from the start.
Your designs, your proof.
BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, straight from Inventor.
👉 Protect your Inventor designs with BORIS
FAQ: the Aspera Faspex and OpenSSH flaws and Inventor teams
What is CVE-2026-123218?
It is an authorization bypass in IBM Aspera Faspex 5.0.0 through 5.0.19, rated 9.8 by IBM, that can give an attacker full administrative privileges. The fix is version 5.0.19 PL1. CISA added it to its list of exploited vulnerabilities on 9 November 2026.
Does the Faspex attacker need an account?
IBM's description mentions an authorized user, but its CVSS vector says no privileges are required, and the bulletin does not explain the difference. Treat it as exploitable without an account until IBM clarifies.
What is SSHole?
SSHole is the nickname of CVE-2026-123158, a password authentication bypass in OpenSSH on some Linux systems that use the musl C library without PAM, such as Alpine Linux. It is fixed in OpenSSH 10.6p2, released on 5 November 2026, and in distribution updates.
Are all Linux servers affected by SSHole?
No. Mainstream distributions that use glibc and PAM, such as Ubuntu, Debian and Red Hat Enterprise Linux, are not affected as described. The risk is on musl-based systems without PAM where SSH password logins are allowed.
Are Autodesk Inventor or Vault affected?
No. Both run on Windows and neither flaw is in Autodesk software. The risk is in the file transfer servers, SFTP boxes, containers and small Linux systems that store or move Inventor files.
What should we do first?
Find every Faspex server and SSH login that faces the internet. Patch Faspex to 5.0.19 PL1, update OpenSSH on Alpine and other musl-based systems, and switch off SSH password logins where you can. Then check for unknown admin accounts and SSH keys.
How do we limit the damage of a future transfer server breach?
Send only the files a partner needs, delete packages after delivery, keep a log of what went where, restrict the server to known partners where possible, and watch for new admin accounts and unusual downloads.
How does BORIS help?
BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when. It does not patch servers or stop a breach, and it does not replace access control or backups.