IBM published a bulletin on Nov 7 saying Aspera Faspex 5.0.0 through 5.0.19 has an incorrect authorization flaw, CVE-2026-123218, that lets a user craft a specific message to bypass authorization and gain full administrative privileges, rated CVSS 9.8 [1]. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Nov 9 with a Nov 12 deadline for federal agencies, listing ransomware use as unknown [2]. Organizations running Aspera Faspex 5 should upgrade to 5.0.19 PL1 now and confirm the faspex-core image is 5.0.19 (1ce4b13, Fix Pack: 1); IBM lists no workarounds [1].
IBM Aspera Faspex 5 authorization flaw CVE-2026-123218 exploited and added to KEV, allows escalation to full admin
1 min read
- Disclosed
- Nov 7, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- 0.5%, higher than 46% of CVEs
- Exploitation and patch status
- ExploitedKEVPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: IBM Aspera Faspex
What to do nowOur advice
Organizations running Aspera Faspex 5 should upgrade to 5.0.19 PL1 now and confirm the faspex-core image is 5.0.19 (1ce4b13, Fix Pack: 1); IBM lists no workarounds [1]
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| IBM Aspera Faspex | 5.0.0 - 5.0.19[1] | 5.0.19 PL1 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
References
Official / primary2
- [1]
“IBM Aspera Faspex 5.0.19 PL1 has addressed a vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.”
- [2]CISA2026-11-09
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.