Federal patch deadlines hit hardest when the vendor fix is barely out of the door. Two additions to CISA’s Known Exploited Vulnerabilities catalog arrived Monday with exactly that problem.
The first is CVE-2026-123218 in IBM Aspera Faspex, carrying a CVSS score of 9.8. It is an authorization bypass reachable through crafted messages that lets an authenticated user climb to full administrative privileges. IBM shipped a fix in Aspera Faspex 5.0.19 PL1 on Friday.
The second is CVE-2026-116779 in SignalWire FreeSWITCH, also 9.8. The fault is a parsing quirk: a plus sign inside the To user of an inbound SIP MESSAGE becomes the split point, and whatever sits to its left is read as a chat protocol selector. Since that selector comes from the message itself, a peer decides which protocol handles the traffic and can therefore determine the API command the server runs. Those commands inherit FreeSWITCH process privileges. Version 1.11.3 carries the patch.
Exploitation confirmed, details thin
SignalWire’s October 28 advisory does confirm attacks in the wild. It simply says nothing about what they looked like. IBM’s advisory does not mention exploitation at all, and no public detail has emerged.
Under BOD 26-04, federal agencies have three days to patch both. Inbound chat ships enabled on the stock internal and external FreeSWITCH profiles, and any authenticated account is enough to reach it, so exposure may be wider than the deployment count suggests.
Two more names on the same warning
CISA also cited exploitation of CVE-2026-102895 in GPUStack, a 9.8 authentication bypass granting unauthenticated administrative access, plus the recently patched OpenSSH SSHole flaw.
