CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV
Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.
82
CVE-2026-123218
Authorization bypass to admin in IBM Aspera Faspex 5.0.x
CISA: IBM Aspera Faspex Incorrect Authorization Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p54
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
IBM Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a specific message that bypasses user authorization. Success grants full administrative privileges. The issue is incorrect authorization (CWE-863). IBM has not listed a fixed release.
What to do: IBM has not listed a fixed version. Apply IBM's update for CVE-2026-123218 when it is published.
| Product | Affected |
|---|---|
| IBM Aspera Faspex | 5.0.0 through 5.0.19 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
KEVCISA Known Exploited Vulnerability
- Affected
- IBM Aspera Faspex
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
6 storiesCISA says IBM Faspex and FreeSWITCH flaws are exploited in attacks
Agencies must patch CVE-2026-123218 and CVE-2026-116779 within three days; GPUStack and SSHole are also listed as exploited.
82
CISA adds exploited OpenSSH, GPUStack, FreeSWITCH, and IBM flaws to KEV
FCEB agencies must apply fixes by November 12; SSHole activity includes miners, metadata queries, and a Python C2 agent.
82
CISA adds four exploited vulnerabilities to the KEV catalog
The additions cover GPUStack, FreeSWITCH, OpenSSH, and Aspera Faspex; federal agencies must prioritize exposed assets that yield full control.
82
CISA adds IBM Aspera Faspex flaw to KEV (CVE-2026-123218)
An authenticated user can craft a message to bypass authorization and escalate privileges; action is due November 12.
76
IBM Aspera Faspex flaw listed as exploited, grants full admin rights
CVE-2026-123218 affects Faspex 5.0.0 through 5.0.19; IBM’s fix is 5.0.19 PL1, with a claimed November 12 deadline.
74