[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYUyd8S6jWYyKAgSYM2lAkqGa8CYtf45gy5jU8K9AEYA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"0fe3ce2e-eeff-4808-a825-5057c24f59ae","critical-unpatched-vulnerabilities-in-ibm-aspera-faspex-and-freeswitch-actively-exploited","89d807ef-6030-46a0-b8a1-f6c8dc2e61bf","Critical Unpatched Vulnerabilities in IBM Aspera Faspex and FreeSwitch Actively Exploited","Threat actors are actively exploiting two CVSS 9.8 vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch, both of which allow attackers to gain elevated or arbitrary command execution capabilities on affected systems. The Faspex flaw enables authenticated users to bypass authorization controls and escalate to administrative privileges, while the FreeSwitch vulnerability permits arbitrary code injection at process level — both representing catastrophic failure points in enterprise infrastructure. CISA's addition to the Known Exploited Vulnerabilities catalog with a three-day federal patching mandate underscores the severity and active exploitation in the wild. This incident illustrates that delays in applying patches to internet-facing, high-value systems directly translate into real-world compromise, particularly when CVSS scores signal near-maximum severity.","**Immediate actions:**\n- Apply vendor-supplied patches for CVE-2026-123218 (IBM Aspera Faspex) and CVE-2026-116779 (SignalWire FreeSwitch) immediately, prioritising internet-facing instances.\n- Cross-reference your asset inventory against CISA's KEV catalog daily to identify any currently exploited products in your environment.\n- Restrict network access to affected services via firewall rules or VPN gating until patches are confirmed applied.\n\n**Long-term improvements:**\n- Establish a risk-tiered emergency patching SLA (e.g., 24–72 hours for CVSS ≥9.0 on internet-facing assets) aligned with CISA BOD mandates.\n- Maintain a continuously updated, authoritative inventory of all software and appliances, including version numbers, to accelerate patch impact assessments.\n- Implement least-privilege access controls and enforce multi-layer authorization checks to limit the blast radius of authentication bypass flaws.\n\n**Detection measures:**\n- Deploy behavioural monitoring and alerting on administrative privilege escalation events within file-transfer and VoIP platforms.\n- Enable centralised logging of all authentication and authorisation events for covered systems and route them to a SIEM for anomaly detection.\n- Conduct regular authenticated and unauthenticated vulnerability scans against all external-facing assets to detect unpatched exposures before attackers do.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; the active exploitation of these unpatched systems represents exactly the preventable incident NIS2 Article 21(2)(b) aims to guard against.","Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches promptly; the failure to patch CVSS 9.8 vulnerabilities in internet-facing infrastructure violates this core principle.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timelines — directly addressing the failure to patch critical vulnerabilities in Faspex and FreeSwitch before threat actors exploited them.","Both exploited products represent known, unpatched components in production environments; A06 specifically calls out the risk of running software with known vulnerabilities and the need for timely updates.","Both vulnerabilities carried CVSS 9.8 scores and had known patches; a continuous vulnerability management programme with risk-tiered remediation SLAs would have mandated patching before active exploitation began.","This control requires organisations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven faster patching of these actively exploited critical flaws.","The IBM Aspera Faspex authorization bypass flaw allowed authenticated users to escalate privileges, highlighting the need for robust authorization enforcement that this control explicitly requires.","published","2026-11-10T10:21:29.290593+00:00","2026-11-10T10:21:29.273+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks\u002F","ibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks-e9fdf2","IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]