IBM Aspera Faspex authorization bypass lets remote attackers gain admin control (CVE-2026-123218)

What happened

IBM Aspera Faspex 5.0.0 through 5.0.19 contains an authorization bypass (CWE-863). An attacker can craft a specific message to bypass user authorization and gain full administrative privileges. The CVE record's CVSS 3.1 vector rates this critical at 9.8, reachable from the network with no privileges and no user interaction, and with high impact on confidentiality, integrity and availability.

IBM's description refers to an authorized user, while the CVSS vector records no privileges required. Treat the service as reachable without prior access unless your deployment proves otherwise.

CISA added CVE-2026-123218 to the KEV catalog on 9 November 2026 and its SSVC assessment marks exploitation as active and automatable, with total technical impact. IBM has not published a workaround.

Who is affected

IBM Aspera Faspex versions 5.0.0 through 5.0.19 are affected. Faspex is typically used for managed large-file transfer. Organisations should check whether the Faspex web or management interface is reachable from untrusted networks. No other affected products are listed.

What to do now

1. Apply IBM's remediation. IBM's advisory indicates a fix is available, but no fixed release number is listed on this page; check the IBM support page for the current remediated release for your installed version.
2. Restrict network exposure of the Aspera Faspex interface to trusted users and networks while you test and deploy the update.
3. Review Aspera Faspex administrator accounts, roles and privileges for unexpected additions or changes.
4. If you cannot patch immediately, monitor Aspera Faspex audit logs and consider taking the interface off the public internet until the update is applied.

How to detect it

IBM's advisory provides no indicators of compromise. Review Aspera Faspex administrator accounts and audit logs for unexpected privilege changes, new administrative accounts, or changes to transfer policies.

Beyond the patch

The exploitation status is the immediate concern: CISA's KEV entry and SSVC assessment both mark this as actively exploited, and the CVSS vector means an exposed Faspex interface can be taken over without credentials. Managed Detection & Response (MDR) monitors for the privileged access changes that follow exploitation, and Virtual CISO Services (vCISO) can help identify and reduce exposed services before they are targeted.