CVE-2026-123218: IBM Aspera Faspex auth bypass exploited

Call: Patch now. CISA added CVE-2026-123218 to KEV on November 9 with a due date of November 12, two days after IBM published the fix. IBM’s bulletin doesn’t mention exploitation. CISA’s listing does, and it’s the newer fact. Faspex has been a favorite target before.

What breaks: IBM says a user “could craft a specific message to bypass user authorization and gain full administrative privileges.” IBM’s text calls it an authorized user, but its own CVSS vector says no privileges are required (9.8, PR:N). Plan for the worse reading until IBM clarifies.

Who’s hit: IBM Aspera Faspex 5.0.0 through 5.0.19, on Linux.

Fix: Faspex 5.0.19 PL1, published November 7. IBM says to validate that the faspex-core container image is “5.0.19 (1ce4b13, Fix Pack: 1).” Check the image, not just the version string in the UI.

Workaround: None, per IBM. Keep Faspex off the open internet until it’s patched if you can. After that, review admin accounts and recent admin actions.

Sources: IBM security bulletin 7295921 (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-123218: IBM Aspera Faspex auth bypass exploited

Sources

More from November 2026 patch cycle