Vulnerability · critical · CVSS 9.8
IBM Aspera Faspex and SignalWire FreeSWITCH flaws exploited, added to KEV
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Organizations running IBM Aspera Faspex or SignalWire FreeSWITCH
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Exploited in the wild · Remote, no login · Full takeover
What to do
- Check whether IBM Aspera Faspex or SignalWire FreeSWITCH is deployed in your environment.
- Apply the patches for CVE-2026-123218 and CVE-2026-116779.
The Brief
- CISA added CVE-2026-123218 and CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) catalog.
- The flaws affect IBM Aspera Faspex and SignalWire FreeSWITCH and are reported as exploited in attacks.
- CISA urges federal agencies to patch them within three days.
Why it matters
Both products are actively targeted, so developers and operators running either one should check versions and apply fixes promptly.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: IBM Aspera Faspex and FreeSWITCH are enterprise file-transfer and telephony servers that IT teams run. |
| No | Core infrastructure | Judgment: these are individual vendor products, not core infrastructure like OpenSSH or the Linux kernel. |
| No | Popular tool | Judgment: Faspex is an enterprise product and FreeSWITCH is a niche telephony server, not mainstream developer tech. |
| Yes | Exploited in the wild | CISA SSVCCISA rates exploitation of CVE-2026-123218 as active |
| No | Public exploit | SecurityWeek does not say exploit code or a proof-of-concept is published. |
| Yes | Remote, no login | CVSSCVE-2026-123218: CVSS 9.8 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-123218: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | SecurityWeek does not report that credentials, data or configs were stolen or exposed. |
| No | Supply chain | SecurityWeek describes exploitation of vulnerabilities, not compromised packages, updates or build pipelines. |
| No | No fix yet | SecurityWeek urges agencies to patch within three days, implying fixed versions are available. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-123218 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
IBM Aspera Faspex Authorization Bypass
- Exploited
- CISA rates exploitation active
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 34% of all CVEs
- Weakness
- CWE-863
CVE-2026-116779 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
- Exploited
- CISA rates exploitation active
- EPSS
- 1.3% chance of exploitation in the next 30 days · higher than 71% of all CVEs
- Weakness
- CWE-77, CWE-78, CWE-749
Source
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks ↗ SecurityWeek · 2h ago
First seen · 1 source · Full story page · How tiers are decided