IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 10 Nov 2026, 09:48 UTC
What to do
AI-suggested
IBM has released a patch for Aspera Faspex in version 5.0.19 PL1; customers should update immediately. SignalWire has patched FreeSwitch in version 1.11.3; users should apply this update promptly. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog and mandates patching within three days for federal agencies. Organizations should prioritize applying these official fixes to mitigate the risks. No alternative mitigations or workarounds are indicated in the advisories.
Description
Two critical vulnerabilities affecting IBM Aspera Faspex and SignalWire FreeSwitch have been exploited in attacks. CVE-2026-123218 is an authorization bypass in IBM Aspera Faspex allowing authenticated users to gain full administrative privileges. CVE-2026-116779 is a code injection vulnerability in SignalWire FreeSwitch that can lead to sensitive information disclosure, arbitrary call control, and command execution. Both vulnerabilities have high severity scores (9.8) and have been added to CISA's Known Exploited Vulnerabilities catalog with urgent patching guidance.