IBM Aspera Faspex flaw CVE-2026-123218 lets users gain admin rights

If you run IBM Aspera Faspex from version 5.0.0 through 5.0.19, plan to patch now. IBM's security bulletin and the US Cybersecurity and Infrastructure Security Agency (CISA) both cover the flaw, tracked as CVE-2026-123218. CISA added it to its Known Exploited Vulnerabilities catalog on November 9, 2026, with a remediation due date of November 12, 2026. IBM rates the flaw 9.8 out of 10 on the CVSS severity scale, which is critical.

The public record was published on November 7, 2026. The sources do not say who is exploiting the flaw, how many systems have been hit, or whether it is being used in ransomware attacks. CISA lists ransomware use as unknown.

How the flaw works

The weakness is classed as CWE-863, Incorrect Authorization. Authorization is the check that decides whether a user may perform an action. In this flaw, the check is not carried out correctly. A user can send a specific message that gets past the check and grants full administrator privileges.

IBM describes the attacker as an authorized or authenticated user. The CVSS vector, however, lists no privileges required, which assumes no prior account. Until you confirm how your installation is reached, treat the service as open to anyone who can contact it over the network.

Who is exposed

Any installation of IBM Aspera Faspex from 5.0.0 through 5.0.19 is in scope. IBM's bulletin also lists other Aspera products, including Aspera Faspex On Demand version 3.7 and Aspera Enterprise version 1.0. The bulletin does not say those products are affected by this CVE, so confirm with IBM before assuming either way.

CISA's listing asks each organisation to judge its own internet exposure. Servers reachable from the internet should be handled first.

The fix and what is missing

IBM says Aspera Faspex 5.0.19 PL1 addresses the flaw and strongly recommends upgrading now. On Linux, IBM asks administrators to confirm that the faspex-core container image reads 5.0.19 with fix pack 1. Follow IBM's upgrade instructions rather than improvising.

IBM lists no workarounds or mitigations. The National Vulnerability Database record for the CVE shows no fixed version, so the IBM bulletin is the source to rely on for the fix level.

What administrators should do now

Start with internet-facing systems, then move to any Faspex server with many user accounts. Upgrade to 5.0.19 PL1 as IBM directs.

Because the flaw is in the KEV catalog, CISA calls for forensic triage. Review logs before and after patching. Look for administrator accounts you do not recognise and for unexpected changes to users or permissions.

If you cannot patch, the sources offer no workaround. CISA's directive text says to discontinue use of the product when mitigations are unavailable, but that guidance is written for cloud services. Isolate the system from untrusted networks and contact IBM support for advice.

The EPSS model estimates a 0.535% chance of exploitation within 30 days. That figure is a forecast. The KEV listing is the stronger signal, because it records known exploitation.