CISA Adds Exploited IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities to KEV Catalog
The Cybersecurity and Infrastructure Security Agency warned that threat actors are actively exploiting critical flaws in IBM Aspera Faspex and SignalWire FreeSwitch. CVE-2026-123218 is an authorization bypass in Aspera Faspex that allows authenticated users to obtain full administrative privileges via crafted messages. IBM released version 5.0.19 PL1 to address the issue. CVE-2026-116779 affects SignalWire FreeSwitch and enables code injection leading to sensitive data disclosure, arbitrary call control, and command execution with the privileges of the FreeSwitch process. Both vulnerabilities were added to the Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches within three days. CISA also highlighted ongoing exploitation of a critical GPUStack authentication bypass and the SSHole flaw in OpenSSH.
SecurityWeekNov 10, 2026Translated from English