CISA says IBM Faspex and FreeSWITCH flaws are exploited in attacks
Original title: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
Agencies must patch CVE-2026-123218 and CVE-2026-116779 within three days; GPUStack and SSHole are also listed as exploited.
CISA added IBM Aspera Faspex CVE-2026-123218 and SignalWire FreeSWITCH CVE-2026-116779, both scored 9.8, to its Known Exploited Vulnerabilities catalog on Monday. Faspex’s authorization bypass, fixed Friday in 5.0.19 PL1, can give authenticated users full administrative privileges. FreeSWITCH 1.11.3 fixes a SIP MESSAGE code-injection bug that can disclose data, control calls, and run commands as the FreeSWITCH process. SignalWire says exploitation has been observed; IBM does not mention attacks, and public attack details are absent. CISA also flagged exploited GPUStack CVE-2026-102895 and SSHole CVE-2026-123158.
Unconfirmed: IBM’s advisory does not mention exploitation, and neither vendor has published attack details.
- Faspex CVE-2026-123218 is an authorization bypass via crafted messages.
- FreeSWITCH CVE-2026-116779 splits the SIP To user on a plus sign.
- Stock chat profiles and passwordless directory users can remove a barrier.
- Federal agencies have three days to patch under BOD 26-04.
- GPUStack was flagged as exploited at the end of July; SSHole over the weekend.
Impact: Faspex admin takeover; FreeSWITCH command execution and call control
| Product | Affected | Fixed in |
|---|---|---|
| IBM Aspera Faspex | — | 5.0.19 PL1 |
| SignalWire FreeSWITCH | — | 1.11.3 |
| GPUStack | — | — |
| Linux distributions affected by SSHole | certain Linux distributions | — |
- 1.Update IBM Aspera Faspex to 5.0.19 PL1.
- 2.Update SignalWire FreeSWITCH to 1.11.3.
- 3.Federal agencies should patch both KEV flaws within three days.
- Vendors
- IBMSignalWire
- Products
- Aspera FaspexFreeSWITCHGPUStack
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102895 | Authentication bypass in GPUStack before 2.2.0 | 9.8 | <1% | KEVPoC | KEV |
| CVE-2026-116779 | Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message() | 9.8 | 2% | KEVPoC ×2 | KEV |
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |
From the original article
2 min read at securityweek.com
CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.