[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhDyydoa1cI1h8GYZ5qGZkJNeEWqgsx8OdCOS4nsQnKk":3},{"article":4,"iocs":48,"watch_terms":62,"solutions":63,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"89d807ef-6030-46a0-b8a1-f6c8dc2e61bf","IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks","ibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks-e9fdf2","CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.","CISA warned that threat actors are actively exploiting critical vulnerabilities in IBM Aspera Faspex (CVE-2026-123218, CVSS 9.8) and SignalWire FreeSwitch (CVE-2026-116779, CVSS 9.8). The Faspex flaw allows authenticated users to escalate to administrative privileges via authorization bypass, while the FreeSwitch code injection enables arbitrary command execution with process privileges. Both vulnerabilities were added to CISA's KEV catalog with a three-day patching mandate for federal agencies under BOD 26-04.","CISA adds IBM Faspex and SignalWire FreeSwitch CVEs to KEV catalog as active exploitation confirmed.","https:\u002F\u002Fwww.securityweek.com\u002Fibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002FCISA-KEV.jpg","2026-11-10T09:42:27+00:00","2026-11-10T10:00:35.450662+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"IBM","vendor",{"name":21,"type":22},"Aspera Faspex","product",{"name":24,"type":19},"SignalWire",{"name":26,"type":22},"FreeSwitch",{"name":28,"type":19},"CISA",{"name":30,"type":31},"SIP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59],{"type":50,"value":51,"context":52},"cve","CVE-2026-123218","IBM Aspera Faspex authorization bypass, CVSS 9.8, patched in version 5.0.19 PL1",{"type":50,"value":54,"context":55},"CVE-2026-116779","SignalWire FreeSwitch code injection leading to RCE, CVSS 9.8, patched in version 1.11.3",{"type":50,"value":57,"context":58},"CVE-2026-102895","GPUStack authentication bypass, CVSS 9.8, exploited since end of July",{"type":50,"value":60,"context":61},"CVE-2026-123158","SSHole authentication bypass affecting Linux distributions, exploitation started over weekend",[18,24,28],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":47,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"critical-unpatched-vulnerabilities-in-ibm-aspera-faspex-and-freeswitch-actively-exploited","Critical Unpatched Vulnerabilities in IBM Aspera Faspex and FreeSwitch Actively Exploited","Threat actors are actively exploiting two CVSS 9.8 vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch, both of which allow attackers to gain elevated or arbitrary command execution capabilities on affected systems. The Faspex flaw enables authenticated users to bypass authorization controls and escalate to administrative privileges, while the FreeSwitch vulnerability permits arbitrary code injection at process level — both representing catastrophic failure points in enterprise infrastructure. CISA's addition to the Known Exploited Vulnerabilities catalog with a three-day federal patching mandate underscores the severity and active exploitation in the wild. This incident illustrates that delays in applying patches to internet-facing, high-value systems directly translate into real-world compromise, particularly when CVSS scores signal near-maximum severity.",[157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":165,"PCI DSS Requirement 6":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"OWASP A06:2021 Vulnerable and Outdated Components":168,"CIS Control 7: Continuous Vulnerability Management":169,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; the active exploitation of these unpatched systems represents exactly the preventable incident NIS2 Article 21(2)(b) aims to guard against.","Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches promptly; the failure to patch CVSS 9.8 vulnerabilities in internet-facing infrastructure violates this core principle.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timelines — directly addressing the failure to patch critical vulnerabilities in Faspex and FreeSwitch before threat actors exploited them.","Both exploited products represent known, unpatched components in production environments; A06 specifically calls out the risk of running software with known vulnerabilities and the need for timely updates.","Both vulnerabilities carried CVSS 9.8 scores and had known patches; a continuous vulnerability management programme with risk-tiered remediation SLAs would have mandated patching before active exploitation began.","This control requires organisations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven faster patching of these actively exploited critical flaws.","The IBM Aspera Faspex authorization bypass flaw allowed authenticated users to escalate privileges, highlighting the need for robust authorization enforcement that this control explicitly requires."]