CVE-2026-123218, IBM Aspera Faspex 5.0.0 to 5.0.19: a crafted message bypasses authorization and gives full administrative rights, fixed in 5.0.19 PL1 with no workaround; CISA lists it as exploited two days after IBM's bulletin (CVSS 3.1 9.8)
CISA lists IBM Aspera Faspex 5 admin takeover as exploited; patch to 5.0.19 PL1, IBM names no workaround
Defender actions
- Patch every IBM Aspera Faspex 5 server on Linux to 5.0.19 PL1 by patching its container images (the faspex-core image must read 5.0.19, Fix Pack 1), portals reachable from the internet first, then review the administrator accounts, API keys and shares created since the server was reachable, because IBM lists no workaround and the fix does not undo an administrator takeover.
Analysis
IBM's bulletin of 2026-11-07 says Aspera Faspex 5.0.0 through 5.0.19 contains CVE-2026-123218, an incorrect-authorization flaw (CWE-863) in which an authorized user can craft a specific message to bypass user authorization and gain full administrative privileges; IBM scores it CVSS 3.1 9.8 with a vector that needs no privileges and no user interaction (IBM, 2026-11-07). The description speaks of an authorized user while the vector requires no privileges, and the bulletin does not resolve the difference. The fix is Faspex 5.0.19 PL1 on Linux, applied by patching the container images and checking that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1); IBM lists no workaround or mitigation (IBM, 2026-11-07). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09, two days after IBM's bulletin, "based on evidence of active exploitation" that it does not describe (CISA, 2026-11-09). IBM's bulletin does not mention exploitation, and neither it nor CISA's listing gives an actor, a victim or the mechanism of the crafted message.
Cited evidence
IBM Aspera Faspex 5 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
based on evidence of active exploitation
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.