CISA has added an IBM Aspera Faspex authorization flaw, CVE-2026-123218, to its Known Exploited Vulnerabilities catalogue with a date added of 9 November 2026 and a remediation due date of 12 November 2026. The defensive move for operators is immediate: IBM’s fix is Aspera Faspex 5.0.19 PL1 (5.0.19.1), and the vendor lists no workarounds.
Aspera Faspex is IBM’s package for high-speed file exchange. Incorrect authorization on a transfer platform is an admin-escalation problem, not a theoretical scoring exercise. CISA’s KEV listing, under BOD 26-04, also flags forensic triage as required. Known ransomware campaign use is listed as Unknown.
What IBM and CISA each say
IBM’s security bulletin (initial publication 7 November 2026) says Aspera Faspex 5 “could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.” The bulletin summary uses “authenticated user” for the same bypass path. CWE is CWE-863 (Incorrect Authorization). IBM’s CVSS base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H—that vector codes privileges required as none.
CISA’s KEV short description says the product “contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.” The prose on both sides talks about an authenticated or authorized user; IBM’s published vector says PR:N. Keep both wordings visible rather than collapsing them into one privilege story.
Affected versions are IBM Aspera Faspex 5.0.0 through 5.0.19. The fix is 5.0.19 PL1 on Linux. IBM tells operators to validate that the faspex-core container image is 5.0.19 (digest tag 1ce4b13, Fix Pack 1). Workarounds and mitigations: none. IBM’s Faspex 5 release notifications date 5.0.19.1 to 6 November 2026.
Patch now; there is no temporary switch
IBM “strongly recommends addressing the vulnerability now by upgrading.” With an empty workaround section, the only vendor path is the PL1 build. Federal and BOD 26-04-covered environments also face CISA’s short due date and forensic-triage expectations. Internet-exposed Faspex instances should be treated as high priority for upgrade validation, not for waiting on a compensating control that IBM says does not exist.
This KEV addition sits in the same week as other catalogue updates TSN has covered, including FreeSWITCH code injection CVE-2026-116779, GPUStack auth bypass CVE-2026-102895, and SonicWall SSLVPN authentication. The shared operational lesson is the same: when CISA marks a flaw exploited and the vendor publishes a fixed build with no workaround, the queue is patch verification, not debate about who was scanning it.
Privilege text and CVSS can disagree; the fix does not
Security teams often argue over whether a flaw needs a stolen session first. Here the documents themselves disagree on that framing. IBM’s narrative describes an authorized or authenticated user crafting a message; IBM’s own CVSS vector still sets PR:N. CISA’s catalogue text stays with the authenticated-user wording. Operators should not wait for that tension to resolve before installing 5.0.19.1.
What matters for transfer desks and media workflows that still run Faspex 5 is simpler. Confirm the faspex-core image hash, take the PL1 upgrade path IBM documents, and record forensic-triage steps where BOD 26-04 applies. Public sources do not name an exploitation actor for this CVE; that absence is not a reason to delay.
The next useful signals are IBM’s post-fix advisories, if any, and whether NVD’s enriched record later restates the privilege metrics. Until then, treat Aspera Faspex CVE-2026-123218 as a KEV with a published fix and an empty workaround list—upgrade to 5.0.19.1 and verify the container image.
File-transfer stacks that sit on shared storage and publisher workflows are especially easy to leave on an older container tag after the host OS is patched. The faspex-core image check IBM spells out is the control that catches that drift.
Sources
- IBM Security Bulletin: Aspera Faspex authorization bypass (CVE-2026-123218)
- CISA Known Exploited Vulnerabilities Catalog
- NVD: CVE-2026-123218
- IBM Aspera Faspex 5 release notifications
Related stories
CISA’s FreeSWITCH KEV addition is the nearest same-week catalogue update for how short due dates and vendor fixes are landing together.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
