Skip to content

IBM Aspera Faspex flaw in CISA KEV: CVE-2026-123218

CISA added IBM Aspera Faspex flaw CVE-2026-123218 to its Known Exploited Vulnerabilities catalog on 9 November 2026: an authorisation bypass in Faspex 5.0.0 to 5.0.19 can give an attacker full administrative privileges. Teams that run Faspex 5 for managed file transfer should upgrade to 5.0.19 PL1 now; CISA's federal due date is 12 November 2026.

Do this today

What: IBM Aspera Faspex authorisation bypass, CVE-2026-123218, in CISA's KEV catalog since 9 November 2026.
Who is exposed: anyone running IBM Aspera Faspex 5.0.0 to 5.0.19, above all with the web interface reachable from the internet.
The one action: check the faspex-core version and upgrade every server to 5.0.19 PL1. CISA's due date: 12 November 2026.
For the Microsoft 365 side of the same estate, the M365 Hardening Kit has a free Top 10 with read-only checks.

Runbook card

What changes: nothing on your side changes by itself. A known, exploited flaw lets a crafted message bypass Faspex authorisation and gain full administrative privileges.
Who: IBM Aspera Faspex 5.0.0 to 5.0.19.
By when: now. CISA due date for US federal agencies: 12 November 2026.
Do this: 1. Find every Faspex 5 server you run, including test and partner-facing ones. 2. Upgrade to 5.0.19 PL1 (IBM lists no workaround). 3. On any server that ran a vulnerable version while reachable, review Faspex accounts and administrator changes you cannot explain.
Check: the faspex-core container image must read "5.0.19 (1ce4b13, Fix Pack: 1)" after the upgrade, as IBM's bulletin says.
Source: IBM security bulletin and the CISA KEV catalog (catalog version 2026.11.09).

What IBM and CISA say

IBM's bulletin is titled "IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass". It rates CVE-2026-123218 CVSS 3.1 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), weakness CWE-863 Incorrect Authorization. IBM's text says the flaw "could allow an authorized user to craft a specific message to bypass user authorization" and "gain full administrative privileges". Note the mismatch: the text speaks of an authorised user, while the CVSS vector says no privileges are required (PR:N). Treat the server as exposed to anyone who can reach it until it is upgraded.

IBM's remediation: "IBM strongly recommends addressing the vulnerability now by upgrading" to 5.0.19 PL1 (Linux). Workarounds: "None". The bulletin does not mention exploitation; the KEV listing is the evidence that the flaw is exploited.

CISA added CVE-2026-123218 on 9 November 2026 as "IBM Aspera Faspex Incorrect Authorization Vulnerability", due 12 November 2026. CISA describes it as a flaw that "could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations". Use in ransomware campaigns is listed as "Unknown". CISA's required action is to apply mitigations per vendor instructions, including its forensic triage requirements, or discontinue use of the product if mitigations are unavailable.

What is not public yet: neither IBM nor CISA has published indicators of compromise, attack dates or how many servers were hit. The bulletin's own dates conflict, so we do not state one.

Affected and fixed versions

Product Affected Fixed
IBM Aspera Faspex 5 5.0.0 to 5.0.19 5.0.19 PL1 (faspex-core image "5.0.19 (1ce4b13, Fix Pack: 1)")

How to check (read-only)

Our suggestion, not vendor guidance: on the Faspex host, list the running containers and their image tags, then compare the faspex-core image with the fixed build above.

# Docker or Podman, whichever runs Faspex on the host
docker ps --format '{{.Names}}  {{.Image}}' | grep -i faspex
podman ps --format '{{.Names}}  {{.Image}}' | grep -i faspex

Then check exposure: is the Faspex web interface reachable from the internet, and who can log in to it? Internet-facing file transfer servers are a common target.

How to verify the fix

After the upgrade, the faspex-core image reads "5.0.19 (1ce4b13, Fix Pack: 1)". Then review Faspex users and administrator role changes since early November and explain every entry you did not make.

Rollback and impact

Our suggestion, not vendor guidance: expect the upgrade to restart Faspex, so transfers in progress may stop for a short time. Plan it outside partner transfer windows and tell the teams that send files through it. IBM lists no workaround, so there is no safe way to stay on 5.0.19 or earlier.

Related: GPUStack admin bypass in CISA KEV and SonicWall SSL-VPN KEV brief from the same week, the Threats & vulnerabilities roundup of 6 November, the deadlines guide and more Threats & vulnerabilities news.

Sources

Last reviewed: 10 November 2026. Runbook Lab is not affiliated with IBM or Microsoft.