Critical Unpatched Vulnerabilities in IBM Aspera Faspex and FreeSwitch Actively Exploited
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors are actively exploiting two CVSS 9.8 vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch, both of which allow attackers to gain elevated or arbitrary command execution capabilities on affected systems. The Faspex flaw enables authenticated users to bypass authorization controls and escalate to administrative privileges, while the FreeSwitch vulnerability permits arbitrary code injection at process level — both representing catastrophic failure points in enterprise infrastructure. CISA's addition to the Known Exploited Vulnerabilities catalog with a three-day federal patching mandate underscores the severity and active exploitation in the wild. This incident illustrates that delays in applying patches to internet-facing, high-value systems directly translate into real-world compromise, particularly when CVSS scores signal near-maximum severity.
Tactical Insight
Immediate actions
- Apply vendor-supplied patches for CVE-2026-123218 (IBM Aspera Faspex) and CVE-2026-116779 (SignalWire FreeSwitch) immediately, prioritising internet-facing instances.
- Cross-reference your asset inventory against CISA's KEV catalog daily to identify any currently exploited products in your environment.
- Restrict network access to affected services via firewall rules or VPN gating until patches are confirmed applied.
Long-term improvements
- Establish a risk-tiered emergency patching SLA (e.g., 24–72 hours for CVSS ≥9.0 on internet-facing assets) aligned with CISA BOD mandates.
- Maintain a continuously updated, authoritative inventory of all software and appliances, including version numbers, to accelerate patch impact assessments.
- Implement least-privilege access controls and enforce multi-layer authorization checks to limit the blast radius of authentication bypass flaws.
Detection measures
- Deploy behavioural monitoring and alerting on administrative privilege escalation events within file-transfer and VoIP platforms.
- Enable centralised logging of all authentication and authorisation events for covered systems and route them to a SIEM for anomaly detection.
- Conduct regular authenticated and unauthenticated vulnerability scans against all external-facing assets to detect unpatched exposures before attackers do.