IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

Threat actors are actively exploiting two CVSS 9.8 vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch, both of which allow attackers to gain elevated or arbitrary command execution capabilities on affected systems. The Faspex flaw enables authenticated users to bypass authorization controls and escalate to administrative privileges, while the FreeSwitch vulnerability permits arbitrary code injection at process level — both representing catastrophic failure points in enterprise infrastructure. CISA's addition to the Known Exploited Vulnerabilities catalog with a three-day federal patching mandate underscores the severity and active exploitation in the wild. This incident illustrates that delays in applying patches to internet-facing, high-value systems directly translate into real-world compromise, particularly when CVSS scores signal near-maximum severity.