CVE-2026-123218: IBM Aspera Faspex Incorrect Authorization Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 2 days after the CVE record was published.
VulnCheck KEV lists it since . It cites 1 public report, the first from .
- How likely is exploitation in the next 30 days?
- 0.5%
EPSS score, percentile 45.6 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
IBM strongly recommends addressing the vulnerability now by upgrading: ProductVersionPlatformFix InstructionsIBM Aspera Faspex5.0.19 PL1Linux Please follow the … Full textSolution in the CVE record.
CISA (deadline ): Apply mitigations in accordance with vendor instructions … Full text
- Which versions are affected?
Affected
- 5.0.0 through 5.0.19
Source: CISA KEV 2026.11.10, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
IBM Aspera Faspex Authorization Bypass
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
Solution (from the CVE record)
IBM strongly recommends addressing the vulnerability now by upgrading: ProductVersionPlatformFix InstructionsIBM Aspera Faspex5.0.19 PL1Linux Please follow the instructions here https://www.ibm.com/docs/en/aspera-faspex/5.0.x . Validate that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1)
Required action, set by CISA
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date for this action: .
Linked from CISA's catalog entry
- https://www.ibm.com/support/pages/node/7295921
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-123218
This summary is based on the CVE record and CISA's catalog entry as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | 5.0.0 through 5.0.19 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Weakness
CWE-863
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CVE record last updated | |
| CISA due date for the required action |
More exploited IBM vulnerabilities
- CVE-2026-9198: IBM Langflow Code Injection Vulnerability
- CVE-2022-47986: IBM Aspera Faspex Code Execution Vulnerability
- CVE-2013-3993: IBM InfoSphere BigInsights Invalid Input Vulnerability
- CVE-2015-7450: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- CVE-2019-4716: IBM Planning Analytics Remote Code Execution Vulnerability
- CVE-2020-4427: IBM Data Risk Manager Security Bypass Vulnerability