IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

CISA has confirmed active exploitation of two newly disclosed vulnerabilities affecting IBM Aspera Faspex and SignalWire FreeSwitch, both now added to its Known Exploited Vulnerabilities catalog. CVE-2026-123218, rated 9.8 on the CVSS scale, lets authenticated Faspex users bypass authorization controls through specially crafted messages to seize full admin rights; IBM fixed it in Aspera Faspex 5.0.19 PL1. CVE-2026-116779, also scored 9.8, stems from how FreeSwitch parses the 'To' field in inbound SIP MESSAGE requests, enabling a remote peer to inject commands, leak sensitive data, or hijack call control with the privileges of the FreeSwitch process; SignalWire has shipped version 1.11.3 to address it and confirms in-the-wild abuse. Federal agencies face a three-day deadline under BOD 26-04 to apply both fixes, while CISA separately warned of ongoing attacks against a critical GPUStack authentication bypass (CVE-2026-102895) and the recently disclosed SSHole flaw (CVE-2026-123158) in several Linux distributions.