FreeSWITCH and Aspera Faspex flaws exploited (CVE-2026-116779)

CISA added two critical flaws to its Known Exploited Vulnerabilities catalog on 9 November 2026: a code injection bug in SignalWire FreeSWITCH (CVE-2026-116779) and an authorization bypass in IBM Aspera Faspex (CVE-2026-123218). Both carry a CVSS score of 9.8, and federal agencies must remediate by 12 November 2026, as reported by SecurityWeek and The Hacker News.

What happened

CISA’s KEV listing means it has evidence that attackers are using these flaws in real intrusions. The same KEV update also covered two further products, OpenSSH and GPUStack, which this article does not cover.

The FreeSWITCH bug sits in the code that handles inbound SIP MESSAGE requests. Per NVD, the function splits the “To” user on a plus sign and treats the left side as a chat protocol selector. Choosing the api protocol reaches the FreeSWITCH API executor, so a peer whose message is accepted can run API commands, including ones that execute operating-system commands, with the privileges of the FreeSWITCH daemon.

The Faspex bug lets an authorized user craft a specific message that bypasses authorization checks and grants full administrative privileges.

Am I affected?

You are affected if you run either of these products at an unpatched version:

• SignalWire FreeSWITCH: all versions before 1.11.3.
• IBM Aspera Faspex: versions 5.0.0 up to, but not including, 5.0.19.1 (NVD lists 5.0.19.1 as the fixed version).

For FreeSWITCH, NVD says inbound chat is enabled on the stock internal and external profiles, so default configurations are in scope. Any authenticated profile account is enough, and stock directory users without password material can remove even that barrier in affected configurations.

Why this matters

This section is our analysis, not new reporting. FreeSWITCH commonly sits on the edge of VoIP and telephony networks, where SIP signalling is reachable by many parties. A bug that turns a chat message into command execution gives an attacker a path from the signalling plane to the host, and from there to call routing, credentials and neighbouring systems.

Faspex is a file-transfer platform, so an administrator takeover exposes the data that moves through it and the accounts that manage it. Because both flaws are in KEV with a three-day deadline, treat patching as a same-day task for any internet-reachable instance rather than waiting for a normal change window.

Technical details

• CVE-2026-116779: CVSS 9.8 (network, low complexity, no privileges, no user interaction). Weakness types: CWE-749, CWE-77 and CWE-78. NVD states that exploitation has been observed in the wild.
• CVE-2026-123218: CVSS 9.8 with the same vector. Weakness type: CWE-863 (incorrect authorization).
• KEV: both entries were added on 9 November 2026 with a due date of 12 November 2026. CISA lists known ransomware campaign use as unknown for both.

There is a wrinkle worth noting. The vector for the Faspex flaw says no privileges are required, while the description says an authorized user is needed. Treat any account on the platform, however low-privileged, as a potential starting point.

Details of the attacks are thin. SignalWire’s advisory says exploitation has been observed in the wild but gives no specifics, and IBM’s advisory does not mention exploitation. No indicators of compromise have been published for either flaw, so there are none to list here.

What to do

1. Inventory. Find every FreeSWITCH and Aspera Faspex instance, including test and forgotten ones, and note which are reachable from the internet.
2. Patch. Upgrade FreeSWITCH to 1.11.3 or later. Upgrade Aspera Faspex to 5.0.19.1 or later, following IBM’s advisory.
3. Reduce exposure while you patch. Restrict SIP access to known peers and trusted networks, and disable inbound chat on FreeSWITCH profiles that do not need it. Limit access to the Faspex administration interface.
4. Hunt. On FreeSWITCH, review logs for SIP MESSAGE requests whose “To” user contains a plus sign followed by unusual content, and look for unexpected child processes spawned by the FreeSWITCH service. On Faspex, review recent privilege changes, new administrator accounts and unexpected configuration edits.
5. Assume credential exposure if you were reachable and unpatched. NVD says the FreeSWITCH flaw permits configuration and credential disclosure, so rotate secrets stored on affected hosts.
6. Follow CISA’s required action for the KEV entries: apply the vendor’s mitigations, or stop using the product if mitigations are unavailable.

Related coverage

• Collabora CODE Server flaw exploited in Nextcloud (CVE-2026-110447)
• Arista VeloCloud Orchestrator flaw exploited (CVE-2026-114625)
• Siemens Software Center DLL flaw exploited (CVE-2026-110936)

Sources

• NVD: CVE-2026-116779
• NVD: CVE-2026-123218
• CISA KEV: CVE-2026-116779
• CISA KEV: CVE-2026-123218
• SecurityWeek: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
• The Hacker News: CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
• SignalWire FreeSWITCH fix commit
• IBM security bulletin for Aspera Faspex