CVE-2026-123218: IBM Aspera Faspex 5 Authorization Bypass — Full Administrative Privileges

Background

IBM Aspera Faspex is a file-exchange and transfer-management application used to move large files between organizations and users. Because it brokers access to transferred data, administrative control of it exposes everything it stores and routes. CVE-2026-123218 affects Faspex 5.0.0 through 5.0.19. IBM published its bulletin on 7 November 2026, and CISA added the CVE to KEV on 9 November 2026.

Public technical detail is thin: IBM’s bulletin and the CVE record describe the flaw in one sentence. This article therefore sticks to what IBM and CISA state.

Technical Mechanism

IBM’s description (the bulletin summary says “authenticated user”, the detail text says “authorized user”): Faspex 5 “could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.” IBM classifies it as CWE-863 (Incorrect Authorization). The message type, endpoint and parameter involved are not disclosed.

One point worth noting: IBM’s description says the attacker is an authorized (authenticated) user, yet the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which encodes no privileges required. The score of 9.8 comes from IBM ([email protected]), and NVD displays the same IBM score while its analysis status is still “Undergoing Analysis”. If the description is accurate, a low-privilege account is the realistic prerequisite, and the effective exposure depends on who can obtain an account on an instance.

Real-World Exploitation Evidence

• CISA added the CVE to KEV on 9 November 2026, due 12 November 2026, which indicates CISA has evidence of exploitation.
• IBM’s bulletin does not mention exploitation, and the KEV entry gives no actor or campaign details. The KEV ransomware field reads “Unknown” as of 10 November 2026.
• The only exploitation source is CISA KEV; IBM publishes no indicators and the KEV entry names no actor.

Impact Assessment

Full administrative privileges on Faspex let an attacker act as an administrator of the file-exchange service. IBM does not enumerate specific consequences. Reasonable concerns for defenders, flagged here as inference rather than IBM statements, include access to shared packages and metadata, creation of accounts, and changes to sharing configuration. Organizations that expose Faspex to external collaborators have the broadest population of potential low-privilege accounts.

Affected Versions

IBM lists no workarounds or mitigations.

Remediation Steps

1. Apply Faspex 5.0.19 PL1 by following IBM’s container-image patching instructions referenced in the bulletin.
2. Validate that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1).
3. Since no workaround exists, restrict network access to the Faspex UI and API to required users while patching is scheduled.
4. Review administrator accounts and recent role changes for anything unexpected, and rotate administrative credentials and API keys if exposure is suspected.

Detection Guidance

IBM has published no indicators. Generic checks, not vendor guidance:

• Audit the Faspex administrator list and role-assignment history for accounts elevated outside change control.
• Review application logs for administrative API calls from accounts that are not administrators.
• Look for new users, new access keys or changed sharing settings created shortly after a low-privilege login.

Timeline

References

• IBM Security Bulletin — Aspera Faspex authorization bypass
• CVE record
• NVD — CVE-2026-123218
• CISA Known Exploited Vulnerabilities Catalog