The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to remediate two critical vulnerabilities currently being exploited in the wild. The agency added CVE-2026-123218, affecting IBM Aspera Faspex, and CVE-2026-116779, impacting SignalWire FreeSwitch, to its Known Exploited Vulnerabilities (KEV) catalog. Under the requirements of Binding Operational Directive 26-04, federal entities are mandated to apply the necessary patches within a three-day window.
The vulnerability in IBM Aspera Faspex, identified as CVE-2026-123218, carries a CVSS severity score of 9.8. It functions as an authorization bypass that can be triggered through the submission of specially crafted messages. If successfully exploited, the flaw allows an authenticated user to escalate their privileges to gain full administrative control over the system. IBM confirmed the issue and released a fix on November 6, 2026, in Aspera Faspex version 5.0.19 PL1. While CISA has confirmed active exploitation of this flaw, IBM’s own security advisory does not explicitly mention observed attacks.
SignalWire FreeSwitch is affected by CVE-2026-116779, a code injection vulnerability also rated with a 9.8 CVSS score. This defect stems from how the software processes inbound SIP MESSAGE requests. When the system encounters a plus sign in the ‘To’ user field, it incorrectly splits the string, treating the left side as a chat protocol selector. Because the chat layer permits inbound messages to define which protocol handles the request, an attacker can deliver a message that dictates the API command the server executes. These commands run with the full privileges of the FreeSwitch process, potentially leading to unauthorized command execution, sensitive information disclosure, and arbitrary call control.
SignalWire acknowledged the vulnerability in an advisory published on October 28, 2026, and confirmed that exploitation has been observed in the wild. The company has released version 1.11.3 to address the issue. According to technical documentation from the National Institute of Standards and Technology (NIST), the risk is particularly high because inbound chat is enabled by default on standard internal and external profiles. Furthermore, the advisory notes that in certain configurations, even directory users without password credentials may be able to bypass security barriers to facilitate the attack.
In addition to these two vulnerabilities, CISA has issued warnings regarding other active threats currently impacting enterprise environments. One such threat is a critical authentication bypass in GPUStack, tracked as CVE-2026-102895. This flaw, which also carries a 9.8 CVSS score, allows remote, unauthenticated attackers to achieve full administrative access. Reports indicate this vulnerability has been exploited since late July 2026.
CISA also highlighted the ongoing exploitation of the SSHole vulnerability, identified as CVE-2026-123158. This high-severity authentication defect affects specific Linux distributions and allows remote attackers to gain unauthorized access to system accounts, including the root user. Exploitation of this flaw began over the weekend, shortly after patches were made available to the public. Organizations are encouraged to prioritize the patching of all these identified vulnerabilities to mitigate the risk of unauthorized system access and administrative takeover.
