IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on SecurityWeek .
Summary from SecurityWeek.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-749Exposed Dangerous Method or Function
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-863Incorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
