SecurityWeekIonut Arghire
CISA flags IBM and FreeSwitch flaws exploited in attacks
Part of the CVE-2026-123218 story · since 9 Nov
- Mon 9 Nov, 21:01 UTC. CISA, first report. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 07:30 UTC. The Hacker News, its first report on the story. CISA adds four actively exploited flaws to its KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 10:30 UTC. SecurityWeek, its first report on the story. CISA flags IBM and FreeSwitch flaws exploited in attacks. Cites a CVE in CISA KEV. This article, 4th of 5.
- Tue 10 Nov, 23:00 UTC. Security Affairs, its first report on the story. CISA adds four exploited software flaws to its KEV catalogue. Cites a CVE in CISA KEV.
CISA has added two young vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to patch within three days. The first, CVE-2026-123218, affects IBM Aspera Faspex and is rated with a CVSS of 9.8. It is an authorization bypass that can be exploited via crafted messages, potentially giving authenticated users full administrative privileges. IBM patched the defect in Faspex version 5.0.19 PL1 and urged customers to update promptly.
The second, CVE-2026-116779, affects SignalWire FreeSwitch and also carries a CVSS of 9.8. It is described as a code injection flaw that can lead to sensitive information disclosure, arbitrary call control and command execution. SignalWire’s advisory notes exploitation “in the wild,” but provides no detailed public evidence; IBM’s advisory does not mention exploitation.
The root cause for CVE-2026-116779 lies in a function that splits the ‘To’ user of an inbound SIP MESSAGE when encountering a plus sign, treating the left side as a chat protocol selector. This allows a peer to deliver a message that determines the API command the server will run, with the commands executing under the FreeSwitch process’ privileges. SignalWire FreeSwitch version 1.11.3 was released with patches for the flaw. CISA added both defects to KEV and urged patching within three days under BOD 26-04. CISA also warned of exploitation of GPUStack’s CVE-2026-102895 and OpenSSH’ SSHole alongside these vulnerabilities.
How the story developed
5 articles from 5 outlets since 9 Nov. Quiet since 10 Nov. This was the 4th report, 13 hours after the first.
- Mon 9 Nov, 21:01 UTC. CISA, first report. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 07:30 UTC. The Hacker News, its first report on the story. CISA adds four actively exploited flaws to its KEV catalog. Cites a CVE in CISA KEV.
- Tue 10 Nov, 10:30 UTC. SecurityWeek, its first report on the story. CISA flags IBM and FreeSwitch flaws exploited in attacks. Cites a CVE in CISA KEV. This article, 4th of 5.
- Tue 10 Nov, 23:00 UTC. Security Affairs, its first report on the story. CISA adds four exploited software flaws to its KEV catalogue. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
Show all 5 articles as a listHide the list
- Mon 9 NovDay 01
- CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog21:01 · CISA · official · First report · CISA alert · Known exploited CVE
- Tue 10 NovDay 14
- CISA adds four flaws exploited in the wild to its KEV catalog01:31 · SecurityOnline · Known exploited CVE
- CISA adds four actively exploited flaws to its KEV catalog07:30 · The Hacker News · Known exploited CVE
- CISA flags IBM and FreeSwitch flaws exploited in attacks10:30 · SecurityWeek · Known exploited CVE · This article, 4th of 5
- CISA adds four exploited software flaws to its KEV catalogue23:00 · Security Affairs · Known exploited CVE