Threat watch / Vulnerability
IBM Aspera Faspex: an authorization bypass that grants full admin rights, listed as exploited by CISA
IBM fixed an authorization bypass in Aspera Faspex, its file exchange server, in version 5.0.19 PL1. The flaw (CVE-2026-123218, CVSS 9.8) lets a user craft a message that gives full administrative privileges, according to SecurityWeek. CISA added it to its catalog of exploited vulnerabilities on November 9, 2026. IBM's bulletin does not mention exploitation, and no details on the attacks are public.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- IBM Aspera Faspex
- How it happened
- An authorization bypass (CVE-2026-123218, CWE-863, CVSS 9.8) in IBM Aspera Faspex 5.0.0 to 5.0.19. IBM's bulletin describes it as allowing an authenticated user to bypass authorization; SecurityWeek says a crafted message gives "full administrative privileges". IBM's CVSS vector rates it as needing no privileges, which does not match that wording. How attackers use it in practice is not public.[1][2] Checked 11 Nov 2026
- What was stolen
- Not public yet Checked 11 Nov 2026
- Who was impacted
- Not public yet Checked 11 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-123218
Timeline
- IBM publishes a security bulletin for CVE-2026-123218 in Aspera Faspex 5.0.0 to 5.0.19, fixed in 5.0.19 PL1. It lists no workaround and does not mention exploitation. [1]
- CISA adds CVE-2026-123218 to its Known Exploited Vulnerabilities catalog, with a three-day deadline for federal agencies, according to SecurityWeek; Security Affairs gives a November 12 deadline. Neither CISA nor IBM has shared details on the attacks, and no attacker is named. [2][3]