CISA has added CVE-2026-123218, an authorization flaw in IBM Aspera Faspex, to its Known Exploited Vulnerabilities catalog, with the catalog data also available in CISA’s official GitHub mirror, indicating that the issue has been exploited in attacks. The entry was added on November 9 and gives US federal civilian agencies until November 12 to remediate the flaw. CISA’s KEV record also flags the entry for forensic triage.
IBM says Aspera Faspex versions 5.0.0 through 5.0.19 are affected. The vulnerability allows an authenticated user to craft a specific message that bypasses user authorization and gains full administrative privileges, according to IBM’s security bulletin and the CVE record. IBM assigns it a CVSS 3.1 score of 9.8 and classifies the weakness as CWE-863, or incorrect authorization.
IBM’s bulletin describes an authenticated user crafting the message, while the CVE record uses the term authorized user. Both descriptions contrast with the published CVSS vector, which lists no privileges required; the vendor does not explain the discrepancy. The vector also rates the flaw as network-accessible, low complexity and requiring no user interaction.
IBM says it fixed the issue in Aspera Faspex 5.0.19 PL1. The vendor’s instructions require customers to verify that the faspex-core container image is version 5.0.19, build 1ce4b13 (Fix Pack 1). IBM lists no workaround or mitigation for the vulnerability.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
IBM Aspera Faspex Flaw Added to CISA KEV After Exploitation
