cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CISA Warns of Exploitation of IBM Aspera Faspex and FreeSWITCH Flaws

· Original article ↗

Summary

CISA added IBM Aspera Faspex and SignalWire FreeSWITCH flaws to its KEV catalog after exploitation was reported. The article describes their impacts and patches; details of attacks were not public.

Key points

  • CISA added CVE-2026-123218 in IBM Aspera Faspex and CVE-2026-116779 in SignalWire FreeSWITCH to its Known Exploited Vulnerabilities catalog.
  • CVE-2026-123218 is an authorization bypass that could let authenticated users gain administrative privileges; IBM patched it in Aspera Faspex 5.0.19 PL1.
  • CVE-2026-116779 is a code injection flaw that could enable sensitive information disclosure, arbitrary call control, and command execution; FreeSWITCH 1.11.3 includes a patch.
  • SignalWire said exploitation of the FreeSWITCH flaw had been observed in the wild. IBM's advisory did not mention exploitation, and public attack details were unavailable.
  • CISA also warned of exploitation involving GPUStack CVE-2026-102895 and the SSHole flaw, CVE-2026-123158.

Article Details

Vulnerability Types
  • Authorization bypass
  • Code injection
  • Authentication bypass
  • Authentication issue
Severity
Critical (CVSS 9.8 for CVE-2026-123218, CVE-2026-116779, and CVE-2026-102895); SSHole is described as high-severity.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-102895gpustack · gpustackTracked as CVE-2026-102895 (CVSS score of 9.8), the GPUStack bug could allow remote, unauthenticated attackers to gain full administrative access to vulnerable servers.CVE-2026-116779signalwire · freeswitchTracked as CVE-2026-116779 (CVSS score of 9.8), the SignalWire FreeSwitch bug is described as a code injection issue leading to sensitive information disclosure, arbitrary call control, and command execution.CVE-2026-123158OpenBSD · OpenSSHSSHole, tracked as CVE-2026-123158 and affecting certain Linux distributions, is a high-severity authentication issue that could allow remote attackers to access accounts such as root.CVE-2026-123218IBM · Aspera FaspexThe Faspex flaw, tracked as CVE-2026-123218 (CVSS score of 9.8), is an authorization bypass that can be exploited via crafted messages.

Vendors

IBMThe Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned that threat actors have been exploiting fresh IBM Aspera Faspex and SignalWire FreeSwitch vulnerabilities in attacks.SignalWireThe Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned that threat actors have been exploiting fresh IBM Aspera Faspex and SignalWire FreeSwitch vulnerabilities in attacks.

Products

FreeSwitchThe Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned that threat actors have been exploiting fresh IBM Aspera Faspex and SignalWire FreeSwitch vulnerabilities in attacks.GPUStackCISA also warned organizations of the in-the-wild exploitation of a critical authentication bypass in GPUStack and the recently patched SSHole flaw.IBM Aspera FaspexThe Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned that threat actors have been exploiting fresh IBM Aspera Faspex and SignalWire FreeSwitch vulnerabilities in attacks.

Related Articles