--- schema: 1 kind: vulnerability title: "CVE-2026-123218, IBM Aspera Faspex 5.0.0 to 5.0.19: a crafted message bypasses authorization and gives full administrative rights, fixed in 5.0.19 PL1 with no workaround; CISA lists it as exploited two days after IBM's bulletin (CVSS 3.1 9.8)" headline: "CISA lists IBM Aspera Faspex 5 admin takeover as exploited; patch to 5.0.19 PL1, IBM names no workaround" summary: > IBM's bulletin of 2026-11-07 fixes CVE-2026-123218 in Aspera Faspex 5.0.0 through 5.0.19, an incorrect-authorization flaw that lets a user craft a specific message to bypass authorization and gain full administrative privileges (CVSS 3.1 9.8); the fix is 5.0.19 PL1 on Linux, applied by patching the container images, and IBM lists no workaround. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09 on evidence of active exploitation that it does not describe; IBM's bulletin does not mention exploitation. discovered_at: "2026-11-10T03:55:00Z" updated_at: null event_date: "2026-11-07" run_id: 2026-11-10T0255Z-intel priority: notable immediate_action: null tags: [vulnerabilities, priv-esc, auth-bypass, actively-exploited, cisa-kev, patch-available] regions: [global] sectors: [] entities: ["product:ibm-aspera-faspex"] techniques: [T1190, T1068] affected_products: ["IBM Aspera Faspex"] cves: - id: CVE-2026-123218 cvss: "9.8" epss: null type: priv-esc vector: zero-click auth: post-auth status: [exploited, cisa-kev, patch-available] affected: "IBM Aspera Faspex 5.0.0 through 5.0.19; IBM's description says an authorized user is needed, while its CVSS vector says no privileges are required" fixed: "5.0.19 PL1 (Fix Pack 1) on Linux, applied by patching the container images; no workaround" sources: - url: "https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass" publisher: "IBM (security bulletin, Aspera Faspex)" date: "2026-11-07" role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-11-09" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities catalog" date: "2026-11-09" role: corroborating closed_sources: [] evidence: - quote: "IBM Aspera Faspex 5 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges." publisher: "IBM" source_url: "https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass" - quote: "based on evidence of active exploitation" publisher: "CISA" source_url: "https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog" - quote: "IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations." publisher: "CISA Known Exploited Vulnerabilities catalog" source_url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" verification: multi-source sourcing_note: > IBM's bulletin carries the flaw, the CVSS score and the fix; the exploited status rests on CISA's catalog listing alone, whose evidence CISA does not describe, and IBM does not mention exploitation. The bulletin's description says an authorized user, CISA's catalog text says an authenticated user, and the CVSS vector says no privileges are required; the bulletin does not resolve the difference. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Patch every IBM Aspera Faspex 5 server on Linux to 5.0.19 PL1 by patching its container images (the faspex-core image must read 5.0.19, Fix Pack 1), portals reachable from the internet first, then review the administrator accounts, API keys and shares created since the server was reachable, because IBM lists no workaround and the fix does not undo an administrator takeover." updates: [] migrated_from: null --- IBM's bulletin of 2026-11-07 says Aspera Faspex 5.0.0 through 5.0.19 contains CVE-2026-123218, an incorrect-authorization flaw (CWE-863) in which an authorized user can craft a specific message to bypass user authorization and gain full administrative privileges; IBM scores it CVSS 3.1 9.8 with a vector that needs no privileges and no user interaction ([IBM, 2026-11-07](https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass)). The description speaks of an authorized user while the vector requires no privileges, and the bulletin does not resolve the difference. The fix is Faspex 5.0.19 PL1 on Linux, applied by patching the container images and checking that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1); IBM lists no workaround or mitigation ([IBM, 2026-11-07](https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass)). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09, two days after IBM's bulletin, "based on evidence of active exploitation" that it does not describe ([CISA, 2026-11-09](https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)). IBM's bulletin does not mention exploitation, and neither it nor CISA's listing gives an actor, a victim or the mechanism of the crafted message. **Exposure:** an IBM Aspera Faspex 5 server at 5.0.19 or earlier (IBM lists the fix for Linux), above all one whose portal is reachable from the internet; the tag of the faspex-core container image shows the build ([IBM, 2026-11-07](https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass)). **Detection:** neither source names an indicator or describes the message, so the signal is the outcome: a non-administrator account that acquires administrator rights, new administrator accounts and API keys, and shares or packages created by accounts that did not previously have that access, in Faspex application and web logs. The fix does not undo a takeover that already happened, so the same review applies after patching. **Defender takeaway:** patch Faspex 5 on Linux to 5.0.19 PL1 by patching the container images now, because CISA lists the flaw as exploited and IBM offers no workaround ([IBM, 2026-11-07](https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-has-addressed-vulnerability-could-allow-authorization-bypass); [CISA, 2026-11-09](https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)); then review administrator accounts, API keys and shares created since the server was reachable.