IBM Aspera Faspex flaw listed as exploited, grants full admin rights
Original title: Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User
CVE-2026-123218 affects Faspex 5.0.0 through 5.0.19; IBM’s fix is 5.0.19 PL1, with a claimed November 12 deadline.
IBM published a November 7 bulletin for an authorization bypass in Aspera Faspex. A signed-in user can send a crafted message and gain full administrative privileges inside Faspex, which IBM does not equate with control of the Linux host. A supplied CISA catalog entry lists the flaw as exploited, added November 9, with ransomware use unknown. The outlet could not retrieve that entry independently.
Unconfirmed: The outlet could not independently retrieve the CISA entry, and IBM does not describe campaigns, victims, or methods beyond a crafted message.
- Affected versions are 5.0.0 through 5.0.19, with a CVSS score of 9.8.
- IBM’s fix is Aspera Faspex 5.0.19 PL1; no workaround is listed.
- Admins must confirm build 1ce4b13 and Fix Pack 1.
- The CVSS vector says PR:N, while the description requires a signed-in user.
- The weakness is CWE-863, incorrect authorization.
Impact: full administrative privileges inside Aspera Faspex
| Product | Affected | Fixed in |
|---|---|---|
| IBM Aspera Faspex | 5.0.0 through 5.0.19 | 5.0.19 PL1 |
- 1.Upgrade affected Linux deployments to Aspera Faspex 5.0.19 PL1.
- 2.Confirm faspex-core reports version 5.0.19, build 1ce4b13, and Fix Pack 1.
- CVEs
- CVE-2026-123218
- Vendors
- IBM
- Products
- Aspera Faspex
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
IBM has released a security update for a critical IBM Aspera Faspex vulnerability that lets a signed-in user bypass access checks and gain full administrative privileges. Tracked as CVE-2026-123218, the flaw affects versions 5. 0.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.