An explainer for a vulnerability in IBM Aspera Faspex 5.0.0 through 5.0.19 (a product used to send and share large files) that lets an attacker bypass authorization and obtain administrator privileges. It covers what happens, who is affected and how to respond, from the defender's side and without attack steps.
- CVE
- CVE-2026-123218 (IBM security bulletin 7295921)
- Severity
- CVSS v3.1 9.8 (Critical; vector AV:N/AC:L/PR:N/UI:N; assigned by IBM)
- Type
- Incorrect authorization (CWE-863). A crafted message bypasses authorization and yields administrator privileges
- Preconditions
- Described differently by source. IBM and the CVE record: an authorized user. IBM's CVSS: no privileges required (PR:N). KEV: an authenticated user
- Affected
- IBM Aspera Faspex 5.0.0 through 5.0.19
- Fix
- IBM Aspera Faspex 5.0.19 PL1 (Linux). No workaround listed
- Dates
- IBM bulletin and CVE: 7 November 2026
- Exploitation
- Added to CISA KEV on 9 November 2026 (due 12 November). No mention in IBM's bulletin
Risk of waiting
With administrator privileges an attacker reaches the files held in Faspex, its sharing settings and user management. File-transfer products often hold confidential and very large data exchanged with partners, so the impact does not stay inside the product. CISA marks this KEV entry as requiring forensic triage, not just routine patching.
What the vulnerability is
IBM's bulletin and the CVE record say that in Faspex 5.0.0 through 5.0.19 a crafted message can bypass user authorization and give full administrator privileges. It is classified as incorrect authorization (CWE-863). Neither the bulletin nor this site describes the shape of the message or how to send it.
The notable point is that the preconditions are described inconsistently. This site does not settle on one; it sets the sources side by side.
IBM (bulletin and CVSS)
- CVE record description: an authorized user crafts a message
- CVSS vector: no privileges required (PR:N), no user interaction
- Scored 9.8 (Critical)
CISA (KEV)
- Description: an authenticated user crafts a message
- Authorization is bypassed, causing privilege escalation
- No score (KEV does not publish one)
"Authorized user" and "no privileges required" do not sit together comfortably, and IBM's bulletin does not say which is closer to the truth. A defender should plan for the worst case: an ordinary working account can lead to administrator, and reaching it with no account at all cannot be ruled out.
Who is affected
| Item | Detail |
|---|---|
| Product | IBM Aspera Faspex |
| Affected versions | 5.0.0 through 5.0.19 |
| Fix | 5.0.19 PL1 (Linux). IBM asks you to validate the faspex-core container image |
| Workarounds and mitigations | None, per IBM's bulletin |
| Versions not in the bulletin | Version lines before 5.0.0 and others; ask IBM if you run them |
- The fix is delivered by patching the container images (see IBM's documentation for the procedure).
- If you use Faspex through a reseller or maintenance vendor, judge by the same version and follow your provider's guidance.
How to check whether you are affected
Check your Faspex version
Look at the admin console or the version of the deployed container image. 5.0.0 through 5.0.19 is affected; a fixed deployment is 5.0.19 Fix Pack 1. If production, staging and development are separate, check each one (asset inventory checklist).
Check whether it is reachable from outside
Check whether the Faspex web interface and API can be reached from the internet or from partner networks. For a product in KEV, internet exposure is the biggest factor in setting priority.
List who holds administrator rights
Record the current administrator accounts. This becomes the baseline for spotting unexpected administrators in the post-update review.
What to do today
Update to 5.0.19 PL1 (top priority)
Follow IBM's procedure to bring the container images to the fixed version. Afterwards confirm that the faspex-core image is 5.0.19 (1ce4b13, Fix Pack: 1). The KEV due date is 12 November.
Narrow who can reach it until you can update
IBM gives no workaround. As this site's own addition, limit the source addresses that can reach Faspex to the users and partner networks that need it. This is not a substitute for updating; it only reduces exposure for now.
Review administrator accounts and privilege changes
For the period before the update, look for new administrators, ordinary accounts promoted to higher privileges, and reissued passwords or API keys. Compare against the administrator list you recorded and disable anyone unexpected.
Check sharing and transfer settings and logs
Look for unexpected share links, added recipients, changed transfer settings and unusually large downloads. Because KEV marks this entry for forensic triage, do not stop at the update; check for signs of compromise. The vulnerability remediation playbook covers the process.
Rotate credentials if you find anything suspicious
If you find suspicious administrator activity, rotate administrator passwords, API keys and connected accounts, and tell the partners concerned. Even if you find nothing, record what you checked and over which period.
Exploitation status
- CISA added it to KEV on 9 November 2026 with a due date of 12 November (KEV catalogue version 2026.11.09). This site takes the KEV addition as the basis for exploitation.
- IBM's bulletin says nothing about exploitation. Public information on scale, methods or actors could not be confirmed.
- KEV records ransomware use as Unknown and forensic triage as Yes.
- CISA's assessment (exploitation active, automatable, total technical impact) has been added to the CVE record.
- NVD's status is Undergoing Analysis, and it shows the 9.8 assigned by IBM.
- Faspex has been in KEV before: CVE-2022-47986 (code execution) was added on 21 February 2023, with ransomware use recorded as Known. It is a different vulnerability.
This site's view: the inconsistent preconditions are not a reason to wait
Reasoning "if it needs authentication, we are fine" is risky, for two reasons.
First, Faspex is built to be used by partners, so there are often many external accounts; the more people who can log in, the less an authentication requirement protects you. Second, IBM's CVSS says no privileges are required, and public information cannot settle which description is right. Treat what you cannot settle conservatively: update first, then review administrator changes (authentication vs authorization).
Sources
- IBM — Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass (published 7 November 2026; affected versions, fix, no workaround, CVSS 9.8)
- CVE.org — CVE-2026-123218 (published 7 November 2026; includes CISA's addition)
- NVD — CVE-2026-123218 (Undergoing Analysis; CWE-863)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 9 November, due 12 November; the earlier Faspex entry is in the same catalogue)
Last verified: 10 November 2026.
Read next
- Practice: The vulnerability remediation playbook / Asset inventory checklist
- Deciding: Prioritising with CVSS, EPSS and KEV
- Authentication and authorization: Authentication vs authorization
- Terms: What is CVSS?