IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM — Aspera Faspex
- Added to KEV catalog
- 9 November 2026
- Federal remediation due date
- 12 November 2026
- Weakness classification (CWE)
- CWE-863
AI Breakdown
What it is
CVE-2026-123218 is a critical authorization vulnerability affecting IBM Aspera Faspex versions 5.0.0 through 5.0.19. An authenticated user can exploit this flaw by sending a specially crafted message that bypasses normal permission checks. Successful exploitation allows the user to escalate their privileges and gain complete administrative control over the application.
Why it matters
With a critical CVSS base score of 9.8, this vulnerability allows standard users to completely take over sensitive enterprise file transfer systems. CISA has confirmed active exploitation in the wild by adding it to their catalog, even though its use in ransomware campaigns remains unknown. Gaining administrative rights gives attackers the ability to access, alter, or exfiltrate sensitive organizational data.
Recommended action
IT teams should immediately apply mitigations and updates following IBM vendor instructions and CISA BOD 26-04 guidance. Stakeholders must evaluate the internet exposure of each asset, conduct necessary forensics triage, and meet the required remediation deadline of November 12, 2026. If vendor patches or mitigations are unavailable, discontinue using the product or isolate affected cloud services.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://www.ibm.com/support/pages/node/7295921 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123218
NVD Technical Description
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
More IBM Vulnerabilities
IBM Langflow Code Injection Vulnerability
IBM Aspera Faspex Code Execution Vulnerability
IBM InfoSphere BigInsights Invalid Input Vulnerability
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
IBM Data Risk Manager Directory Traversal Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services