Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

CISA lists exploited IBM Aspera Faspex flaw CVE-2026-123218

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA says CVE-2026-123218 in IBM Aspera Faspex is exploited; agencies must mitigate by November 12, 2026.

CISA added CVE-2026-123218, an incorrect authorization flaw in IBM Aspera Faspex, to the Known Exploited Vulnerabilities catalog on November 9, 2026. An authenticated user can craft a message to bypass authorization and gain administrative privileges inside Faspex, which IBM does not equate with Linux host control, according to Cyber Security News. That outlet says IBM’s November 7 bulletin covers Faspex 5.0.0 through 5.0.19, fixed in 5.0.19 PL1, scored CVSS 9.8, with no workaround. Agencies must apply vendor mitigations under BOD 26-04 by November 12, 2026, or discontinue use; known ransomware use is unknown. Cyber Security News notes the CVSS vector lists no privileges required, conflicting with the signed-in-user description, and says it could not independently retrieve the catalog entry.

Key facts
  • Affects Aspera Faspex 5.0.0 through 5.0.19; IBM fix is 5.0.19 PL1.
  • CWE-863, CVSS 9.8, and no workaround listed.
  • Federal action due November 12, 2026, under BOD 26-04.
  • Known ransomware campaign use is listed as unknown.
  • Admins should confirm build 1ce4b13 and Fix Pack 1.
  • The KEV entry does not name affected or fixed versions.
Analyze CVE-2026-123218 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 7, 2026IBM published the Aspera Faspex authorization-bypass bulletin. · Cyber Security News
  2. Nov 9, 2026CISA added CVE-2026-123218 to the KEV catalog. · CISA Known Exploited Vulnerabilities
  3. Nov 12, 2026Federal mitigation deadline under BOD 26-04. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • CISA Known Exploited VulnerabilitiesKEV listing, BOD 26-04 deadline, and unknown ransomware use.
  • Cyber Security NewsVersions, fix build, CVSS conflict, and Faspex-only admin impact.
CVEs
CVE-2026-123218
Vendors
IBM
Products
Aspera Faspex
Organizations
CISA

Coverage

oldest first · one row per article · UTC
  1. · 2d ago CISA Known Exploited VulnerabilitiesFirst report

    CISA adds IBM Aspera Faspex flaw to KEV (CVE-2026-123218)

    An authenticated user can craft a message to bypass authorization and escalate privileges; action is due November 12.

  2. · 14h ago Cyber Security News

    IBM Aspera Faspex flaw listed as exploited, grants full admin rights

    CVE-2026-123218 affects Faspex 5.0.0 through 5.0.19; IBM’s fix is 5.0.19 PL1, with a claimed November 12 deadline.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-123218
Authorization bypass to admin in IBM Aspera Faspex 5.0.x
9.8<1%KEV
KEV