Skip to content
securitytabs

Updated

CISA flags exploited flaws in IBM Aspera Faspex and FreeSWITCH

US cyber agency CISA says attackers are exploiting serious flaws in IBM's Aspera Faspex file-transfer software and in the FreeSWITCH phone system software. Organizations running either product should check for fixes now, as federal agencies were given only three days.

Exploited flaws in IBM Aspera Faspex and FreeSWITCH
Exploited flaws in IBM Aspera Faspex and FreeSWITCH

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

On November 9, CISA added four flaws to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, citing evidence of active exploitation. Two of them are an incorrect authorization flaw in IBM Aspera Faspex and a code injection flaw in SignalWire FreeSWITCH. The other two affect GPUStack and OpenBSD OpenSSH. [1][2]

The two flaws

CVE-2026-123218 is an authorization bypass in IBM Aspera Faspex, rated 9.8 on the CVSS scale. IBM has published a support page for it. [1][2]

CVE-2026-116779 is a flaw in FreeSWITCH, rated 9.8. According to its project advisory, an inbound SIP MESSAGE (a text message sent over the phone protocol) can select the api chat protocol and run FreeSWITCH API commands. The project has published a fix and a release. [1]

Deadline and what is not known

CISA set a federal due date of November 12 for both, which SecurityWeek describes as three days. The coverage reviewed does not say who is exploiting the flaws, how many organizations are affected or whether ransomware groups are involved. [3][1]

Timeline

  1. CISA urged federal agencies to patch the two flaws within three days. [3]

  2. CISA also listed flaws in GPUStack and OpenSSH as exploited. [1]

  3. CISA added the IBM Aspera Faspex and FreeSWITCH flaws to its KEV catalogue. [1]

  4. · CISA KEV

    CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities catalog.

  5. · CISA KEV

    CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog.

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If you use IBM Aspera Faspex or FreeSWITCH, directly or through a provider, CISA says attackers are exploiting these flaws. [1]

What to do

  1. Ask your IT or hosting provider whether they run either product. [1]
  2. Ask them to confirm the vendor fixes are installed. [2]

Mid-size company

A small IT or security team

What to know

Both flaws are rated 9.8 and CISA gave federal agencies until November 12 to act. [1][3]

What to do

  1. Check your asset inventory for Aspera Faspex and FreeSWITCH servers. [1]
  2. Apply IBM's guidance for Faspex and the FreeSWITCH project's fix. [2][1]

Large enterprise

A security operations team

What to know

No indicators of compromise or attacker details appear in the coverage reviewed. [3]

What to do

  1. Inventory exposed Aspera Faspex and FreeSWITCH instances, including those run by third parties, and patch them. [1]
  2. Review these systems for signs of compromise given that exploitation is confirmed. [1]

Sources

  1. [1]CISA Advisories · Nov 9, 12:00 UTC
    CISA Adds Four Known Exploited Vulnerabilities to Catalogcontext
  2. [2]The Hacker News · Nov 10, 06:31 UTC
    CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flawscontext
  3. [3]SecurityWeek · Nov 10, 09:42 UTC
    IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attackscontext