IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited

The Cybersecurity and Infrastructure Security Agency (CISA) warned on Monday that threat actors have been exploiting fresh vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch, as described in SecurityWeek's report. The Faspex flaw, tracked as CVE-2026-123218, is an authorization bypass with a CVSS score of 9.8, and IBM patched that defect on Friday in Aspera Faspex version 5.0.19 PL1. The FreeSwitch flaw, tracked as CVE-2026-116779, is a code injection issue with the same CVSS score of 9.8, and SignalWire FreeSwitch version 1.11.3 was released with patches.

Federal teams bound by BOD 26-04, IBM Aspera Faspex administrators, and SignalWire FreeSwitch operators are the people this warning is for. SecurityWeek international correspondent Ionut Arghire reported CISA's Monday alert. The warning covers the crafted-message authorization bypass fixed in Aspera Faspex 5.0.19 PL1, the SIP MESSAGE code injection patched in FreeSwitch 1.11.3, a three-day federal patch order, and separate alerts on GPUStack CVE-2026-102895 and SSHole CVE-2026-123158.

01Crafted messages and the Friday fix

CVE-2026-123218 is the IBM Aspera Faspex authorization bypass, and it carries a CVSS score of 9.8. CISA warned on Monday that threat actors have been exploiting this fresh Faspex flaw in attacks, and the bypass can be exploited via crafted messages. Successful exploitation could allow authenticated users to gain full administrative privileges on a Faspex deployment.

IBM patched the security defect on Friday in Aspera Faspex version 5.0.19 PL1 and urged customers to update their deployments as soon as possible. Version 5.0.19 PL1 is the release IBM named for the repair of CVE-2026-123218. The Monday warning says threat actors have been exploiting that authorization bypass, the defect IBM addressed in Friday's 5.0.19 PL1 update.

02Disclosure, call control, and execution

CVE-2026-116779 is the SignalWire FreeSwitch vulnerability, scored at a CVSS of 9.8 and described as a code injection issue. CISA said threat actors have been exploiting this fresh FreeSwitch flaw in attacks. The Monday warning listed it together with the IBM Aspera Faspex authorization bypass, CVE-2026-123218.

This code injection can lead to sensitive information disclosure, arbitrary call control, and command execution. That is the impact described for CVE-2026-116779 on SignalWire FreeSwitch, and the flaw carries the same CVSS score of 9.8 as the IBM Aspera Faspex authorization bypass CVE-2026-123218.

03Plus sign in the To user

The root cause of the weakness is a function that splits the 'To' user of an inbound SIP MESSAGE when encountering a plus (+) sign, while treating the left side as a chat protocol selector. Because the chat layer allows an inbound SIP MESSAGE to select the chat proto that handles it, a peer can deliver a message that controls the API command the server would run. The commands run with the privileges of the FreeSwitch process.

A NIST advisory reads: "Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations." Stock internal and external profiles both have inbound chat enabled. Any authenticated profile account is sufficient, and stock directory users without password material can remove that barrier in affected configurations.

SignalWire FreeSwitch version 1.11.3 was released with patches for the vulnerability. That version is the fix for CVE-2026-116779, a code injection issue with a CVSS score of 9.8 that can lead to sensitive information disclosure, arbitrary call control, and command execution. CISA said on Monday that threat actors have been exploiting this FreeSwitch flaw, which is the defect patched in version 1.11.3.

04Three-day order under BOD 26-04

On Monday, CISA added both security defects to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them within three days, as mandated by BOD 26-04. The defects are CVE-2026-123218 in IBM Aspera Faspex and CVE-2026-116779 in SignalWire FreeSwitch. Each carries a CVSS score of 9.8, and CISA says threat actors have been exploiting both.

SignalWire's advisory, published October 28, notes that exploitation of the FreeSwitch flaw "has been observed in the wild," but provides no details on the attacks. IBM's advisory makes no mention of exploitation. No details on the attacks appear to be public for the Faspex bypass or the FreeSwitch code injection.

05GPUStack access and the SSHole flaw

CISA also warned organizations of the in-the-wild exploitation of a critical authentication bypass in GPUStack and the recently patched SSHole flaw. Tracked as CVE-2026-102895, with a CVSS score of 9.8, the GPUStack bug could allow remote, unauthenticated attackers to gain full administrative access to vulnerable servers. It was flagged as exploited at the end of July.

SSHole, tracked as CVE-2026-123158 and affecting certain Linux distributions, is a high-severity authentication issue that could allow remote attackers to access accounts such as root. Exploitation started over the weekend, days after patches were released. CISA placed that SSHole activity and the GPUStack bypass, flagged as exploited at the end of July, in the same warning as the Faspex and FreeSwitch KEV entries.