# SZB-4703b2a7b4: CISA adds four flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to KEV

CISA added four security flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Multiple vendors (GPUStack, SignalWire, OpenBSD, IBM)
- Product: Aspera Faspex
- Status: Confirmed
- Sources: 9 distinct
- First seen: 2026-11-09 15:52 UTC
- Confirmed: 2026-11-10 06:42 UTC

Written by a model from the sources below. Verify against them.

## Summary

CISA added four security flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The listing names CVE-2026-123218, which CVSS scores at 9.8 and describes as an incorrect authorization vulnerability.

## What to do

- Identify whether GPUStack, FreeSWITCH, OpenSSH, or IBM Aspera Faspex is deployed in your environment
- Apply vendor patches or mitigations for the listed flaws as soon as possible
- Restrict network exposure of affected services until patched
- Review logs for signs of exploitation of these services
- Patch IBM Aspera Faspex to the vendor's fixed version now.
- Check logs for signs of exploitation of both products.

## Timeline

- 2026-11-09 15:51 UTC: Made public by Mastodon
- 2026-11-09 15:52 UTC: First seen by cve.now
- 2026-11-10 06:42 UTC: Confirmed as CVE-2026-123218
- 2026-11-10 20:02 UTC: Record last updated

## Evidence (9 sources)

- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@ssvc/117587278212918590): “Exploitation of this path has been observed in the wild.”
- 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/patchsonar.com/post/3mzvig4yqu32f): “SignalWire FreeSwitch Code Injection Vulnerability” (+1 more: [Bluesky](https://bsky.app/profile/patchsonar.com/post/3mzvvtao3os2f))
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@patchsonar/117587746286456017): “Newly listed by CISA: SignalWire FreeSwitch SignalWire FreeSwitch Code Injection Vulnerability” (+5 more: [Mastodon](https://mastodon.social/@ninjaintelgroup/117588551925340797), [Mastodon](https://infosec.exchange/@patchsonar/117588689877972265), [Mastodon](https://mastodon.social/@ninjaintelgroup/117590202988794806), [Mastodon](https://mastodon.social/@EUVD_Bot/117590620370334989), [Mastodon](https://infosec.exchange/@beyondmachines1/117592744668877027))
- 2026-11-09 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117588032770843834): “Prior to 1.11.2, FreeSWITCH's inbound ICE h” (+3 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117588032841552684), [Mastodon](https://mastodon.social/@EUVD_Bot/117588040553044395), [Mastodon](https://mastodon.social/@EUVD_Bot/117589232044364375))
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@infonewscyber/117588634166017658): “⚠️ FAILLE CRITIQUE CVE-2026-123218 activement exploitée : IBM Aspera Faspex – Autorisation incorrecte”
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@Secquill/117588870430138717): “CISA has added a flaw in IBM Aspera Faspex 5.0.0 through 5.0.19 to its exploited vulnerabilities list.” (+1 more: [Mastodon](https://infosec.exchange/@beyondmachines1/117593924381208018))
- 2026-11-10 · Social · [Mastodon](https://infosec.exchange/@xploitdigest_kev/117590478419192430): “Do you run SignalWire FreeSwitch? CISA lists CVE-2026-116779 as exploited (added 9 Nov 2026).” (+1 more: [Mastodon](https://infosec.exchange/@xploitdigest_kev/117590950231417986))
- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html): “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.”
- 2026-11-10 · Press · [SecurityWeek](https://www.securityweek.com/ibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks/): “CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-4703b2a7b4&body=https%3A%2F%2Fcve.now%2FSZB-4703b2a7b4%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-4703b2a7b4

### Has Multiple vendors (GPUStack, SignalWire, OpenBSD, IBM) confirmed it?

Yes. Confirmed as CVE-2026-123218.

Source: https://infosec.exchange/@ssvc/117587278212918590, https://bsky.app/profile/patchsonar.com/post/3mzvig4yqu32f, https://infosec.exchange/@patchsonar/117587746286456017, https://mastodon.social/@EUVD_Bot/117588032770843834, https://infosec.exchange/@infonewscyber/117588634166017658, https://infosec.exchange/@Secquill/117588870430138717, https://infosec.exchange/@xploitdigest_kev/117590478419192430, https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html, https://www.securityweek.com/ibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks/

### What should Multiple vendors (GPUStack, SignalWire, OpenBSD, IBM) users do?

Identify whether GPUStack, FreeSWITCH, OpenSSH, or IBM Aspera Faspex is deployed in your environment. Apply vendor patches or mitigations for the listed flaws as soon as possible. Restrict network exposure of affected services until patched. Review logs for signs of exploitation of these services. Patch IBM Aspera Faspex to the vendor's fixed version now. Check logs for signs of exploitation of both products.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-123218 and CVE-2026-116779.

Source: https://cve.now/CVE-2026-123218, https://cve.now/CVE-2026-116779

## Tracked as

- [CVE-2026-123218](https://cve.now/CVE-2026-123218.md)
- [CVE-2026-116779](https://cve.now/CVE-2026-116779.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-4703b2a7b4
Site guide for agents: https://cve.now/llms.txt