CriticalCVSS9.82026-11-10
CVE-2026-123218 — IBM Aspera Faspex 5 authorization bypass lets an attacker gain administrator privileges: explainer and fix (fixed in 5.0.19 PL1, listed in KEV)
Incorrect authorization (CWE-863) in IBM Aspera Faspex 5.0.0 through 5.0.19. IBM's bulletin says a crafted message can bypass authorization and give full administrator privileges. Fixed in 5.0.19 PL1; IBM lists no workaround. IBM's CVSS is 9.8 (no privileges required), but CISA's KEV description says an authenticated user, so the preconditions are described inconsistently. Added to KEV on 9 November (due 12 November). This site's view: whichever description is right, patch affected versions first, then review administrator accounts and configuration changes.