CISA warns hackers are exploiting critical flaws in IBM Aspera Faspex and SignalWire FreeSwitch, urging immediate patching.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning that attackers are actively exploiting two newly disclosed, critical vulnerabilities. The flaws affect IBM's Aspera Faspex file-sharing software (CVE-2026-123218) and SignalWire's FreeSwitch communications platform (CVE-2026-116779). Both carry the maximum CVSS severity score of 9.8, with the IBM flaw allowing authenticated users to gain full admin privileges, and the SignalWire bug enabling code injection, sensitive data theft, and takeover of the phone system.

CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch them within three days. SignalWire explicitly states exploitation 'has been observed in the wild.' For any organization using these products, this constitutes an active, high-risk attack campaign requiring immediate defensive action. The takeaway is clear: patch now or face likely compromise.

What to do: Update IBM Aspera Faspex to version 5.0.19 PL1 and update SignalWire FreeSwitch to version 1.11.3.