CISA adds IBM Aspera Faspex flaw to KEV (CVE-2026-123218)
Original title: CISA KEV: IBM Aspera Faspex Incorrect Authorization Vulnerability — IBM Aspera Faspex (CVE-2026-123218)
An authenticated user can craft a message to bypass authorization and escalate privileges; action is due November 12.
CISA added CVE-2026-123218, an incorrect authorization flaw in IBM Aspera Faspex, to the Known Exploited Vulnerabilities catalog. An authenticated user can craft a specific message to bypass authorization and cause privilege escalation. Required action is to apply vendor mitigations under BOD 26-04 by November 12, 2026, or discontinue use if mitigations are unavailable. Known ransomware campaign use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown and does not describe exploitation details.
- The KEV entry does not name affected or fixed versions.
- Stakeholders must assess each asset's internet exposure under BOD 26-04.
- Cloud services must follow applicable BOD 26-04 guidance.
- CISA also points agencies to its forensics triage requirements.
Impact: authenticated privilege escalation via crafted authorization bypass
| Product | Affected |
|---|---|
| IBM Aspera Faspex | — |
- 1.Apply vendor mitigations and meet CISA BOD 26-04 by November 12, 2026.
- 2.Discontinue use of the product if mitigations are unavailable.
- 3.Evaluate internet exposure and follow applicable cloud BOD 26-04 guidance.
- CVEs
- CVE-2026-123218
- Vendors
- IBM
- Products
- Aspera Faspex
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123218 | Authorization bypass to admin in IBM Aspera Faspex 5.0.x | 9.8 | <1% | KEV | KEV |
From the original article
1 min read at cisa.govIBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.