CISA flags IBM Aspera Faspex and SignalWire FreeSwitch flaws as under active attack
Federal agencies have three days to patch both products, which were added to CISA's Known Exploited Vulnerabilities catalog.
US cybersecurity agency CISA has flagged two newly disclosed flaws as under active attack: an authorization bypass in IBM Aspera Faspex (CVE-2026-123218, CVSS 9.8) that can let an authenticated user gain full administrator rights, and a code injection bug in SignalWire FreeSwitch (CVE-2026-116779, CVSS 9.8) that can expose sensitive data, control calls and run commands with the FreeSwitch process's privileges. IBM fixed Faspex in version 5.0.19 PL1 and SignalWire fixed FreeSwitch in 1.11.3, and both are now listed in CISA's Known Exploited Vulnerabilities catalog with a three-day patch deadline for federal agencies. SignalWire says it has seen exploitation in the wild but has not released attack details, while IBM's advisory does not mention exploitation. CISA also reissued warnings about an actively exploited GPUStack authentication bypass (CVE-2026-102895) and the SSHole Linux authentication flaw (CVE-2026-123158), the latter exploited days after patches shipped.
Why it matters
Both flaws carry a CVSS score of 9.8 and have fixed versions available, so organisations running Faspex or FreeSwitch face a near-term risk of account takeover and data exposure. Only SignalWire has said attacks have been seen, and it has released no attack details, while IBM's advisory does not mention exploitation at all. CISA also reissued warnings about the GPUStack and SSHole flaws, the latter exploited days after its patches shipped, which shows that prompt patching remains the central defence.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.