CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

IBM Aspera Faspex 5.0.0 to 5.0.19: crafted message bypasses authorization for full administrative rights (CVSS 9.8); CISA lists it as exploited 2026-11-09; fixed in 5.0.19 PL1

cve · CVE-2026-123218

Coverage
1
first 2026-11-10 → last 2026-11-10
Latest activity
2026-11-10
CISA lists IBM Aspera Faspex 5 admin takeover as exploited; patch to 5.0.19 PL1, IBM names no workaround
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
3
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-123218, newest first. Check the date before acting on an older one.

  • Patch every IBM Aspera Faspex 5 server on Linux to 5.0.19 PL1 by patching its container images (the faspex-core image must read 5.0.19, Fix Pack 1), portals reachable from the internet first, then review the administrator accounts, API keys and shares created since the server was reachable, because IBM lists no workaround and the fix does not undo an administrator takeover.
    2026-11-10CVE-2026-123218

Defender insights

What each entry about CVE-2026-123218 tells a defender to do, newest first.

2026-11-10NOTABLEexploitedCISA lists IBM Aspera Faspex 5 admin takeover as exploited; patch to 5.0.19 PL1, IBM names no workaround

Exposure · detection

Story timeline

  1. 2026-11-10CVE-2026-123218, IBM Aspera Faspex 5.0.0 to 5.0.19: a crafted message bypasses authorization and gives full administrative rights, fixed in 5.0.19 PL1 with no workaround; CISA lists it as exploited two days after IBM's bulletin (CVSS 3.1 9.8)
    trending-vulnerabilitiesCISA lists IBM Aspera Faspex 5 admin takeover as exploited; patch to 5.0.19 PL1, IBM names no workaround

Hunting pivots

Affected products
IBM Aspera Faspex
Tags
actively-exploitedauth-bypasscisa-kevpatch-availablepriv-escvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-10/ibm-aspera-faspex-cve-2026-123218-admin-takeover-kev · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-11-10/ibm-aspera-faspex-cve-2026-123218-admin-takeover-kev · ATT&CK page ↗

Entries about IBM Aspera Faspex 5.0.0 to 5.0.19: crafted message bypasses authorization for full administrative rights (CVSS 9.8); CISA lists it as exploited 2026-11-09; fixed in 5.0.19 PL1 (1)

2026-11-10 · view entry permalink →

NOTABLECVE-2026-123218exploitedNATOA2

CVE-2026-123218, IBM Aspera Faspex 5.0.0 to 5.0.19: a crafted message bypasses authorization and gives full administrative rights, fixed in 5.0.19 PL1 with no workaround; CISA lists it as exploited two days after IBM's bulletin (CVSS 3.1 9.8)

IBM's bulletin of 2026-11-07 says Aspera Faspex 5.0.0 through 5.0.19 contains CVE-2026-123218, an incorrect-authorization flaw (CWE-863) in which an authorized user can craft a specific message to bypass user authorization and gain full administrative privileges; IBM scores it CVSS 3.1 9.8 with a vector that needs no privileges and no user interaction (IBM, 2026-11-07). The description speaks of an authorized user while the vector requires no privileges, and the bulletin does not resolve the difference. The fix is Faspex 5.0.19 PL1 on Linux, applied by patching the container images and checking that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1); IBM lists no workaround or mitigation (IBM, 2026-11-07). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09, two days after IBM's bulletin, "based on evidence of active exploitation" that it does not describe (CISA, 2026-11-09). IBM's bulletin does not mention exploitation, and neither it nor CISA's listing gives an actor, a victim or the mechanism of the crafted message.

IBM Aspera Faspex 5 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

IBM

based on evidence of active exploitation

CISA 2026-11-09

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

CISA Known Exploited Vulnerabilities catalog 2026-11-09
vulnerability10 Nov 03:55Zmulti-sourceOpen finding →
Sources: IBM (security bulletin, Aspera Faspex) · CISA · CISA Known Exploited Vulnerabilities catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov2 (67%)
  • ibm.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)