> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# IBM Aspera Faspex flaw CVE-2026-123218 is now exploited
- URL: https://stackurity.ai/blog/ibm-aspera-faspex-cve-2026-123218-exploited-privilege-escalation/
- Published: 2026-11-11T04:05:06.000Z
- Updated: 2026-11-11T04:05:06.000Z
- Description: CISA lists IBM Aspera Faspex flaw CVE-2026-123218 as exploited. See which versions are in scope and what to do while you wait for the vendor fix.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** CISA now lists CVE-2026-123218 in IBM Aspera Faspex as exploited. A signed-in user can craft a message and take over administrator rights. Affected builds run from 5.0.0 up to 5.0.19.

## What happened

The Hacker News [reports](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html) that CISA put four flaws on its exploited list on Monday, and one of them is in Faspex, IBM's file transfer product. CISA added CVE-2026-123218 on November 9, 2026 and set a due date of November 12, 2026 for agencies to apply the vendor's mitigations.

NVD describes an authorization bypass: an authorized user can craft a specific message to skip the user authorization check and gain full administrative privileges. NVD lists a CVSS v3.1 score of 9.8, and the record was still undergoing analysis when we read it. Check IBM's advisory for the fixed release, because we do not state one here.

## Am I affected?

You are in scope if you run Faspex from 5.0.0 up to 5.0.19\. Faspex is a file transfer service, so it often holds large files for partners and sits where outsiders can reach it. Treat any account that can sign in as a path to administrator rights until you have updated, and review the administrator list and recent activity for changes you do not recognise.

## How to check with Stackurity

Stackurity matches installed packages and runtimes on supported Linux servers against advisories and the CISA catalogue every hour, so a catalogue entry like this one is raised to the top of the list for any host it recognises. If Faspex was installed outside a package manager, confirm the version in its administration page or with the vendor's own tools, since Stackurity does not cover libraries copied into an application outside a package manager. Read the [verification guide](https://stackurity.ai/docs/verification) for how the recheck after a fix works, or [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=ibm-aspera-faspex-cve-2026-123218-exploited-privilege-escalation).

Sources: [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html), [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-123218) and [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-123218).