IBM Aspera Faspex flaw CVE-2026-123218 is now exploited

TL;DR: CISA now lists CVE-2026-123218 in IBM Aspera Faspex as exploited. A signed-in user can craft a message and take over administrator rights. Affected builds run from 5.0.0 up to 5.0.19.

What happened

The Hacker News reports that CISA put four flaws on its exploited list on Monday, and one of them is in Faspex, IBM's file transfer product. CISA added CVE-2026-123218 on November 9, 2026 and set a due date of November 12, 2026 for agencies to apply the vendor's mitigations.

NVD describes an authorization bypass: an authorized user can craft a specific message to skip the user authorization check and gain full administrative privileges. NVD lists a CVSS v3.1 score of 9.8, and the record was still undergoing analysis when we read it. Check IBM's advisory for the fixed release, because we do not state one here.

Am I affected?

You are in scope if you run Faspex from 5.0.0 up to 5.0.19. Faspex is a file transfer service, so it often holds large files for partners and sits where outsiders can reach it. Treat any account that can sign in as a path to administrator rights until you have updated, and review the administrator list and recent activity for changes you do not recognise.

How to check with Stackurity

Stackurity matches installed packages and runtimes on supported Linux servers against advisories and the CISA catalogue every hour, so a catalogue entry like this one is raised to the top of the list for any host it recognises. If Faspex was installed outside a package manager, confirm the version in its administration page or with the vendor's own tools, since Stackurity does not cover libraries copied into an application outside a package manager. Read the verification guide for how the recheck after a fix works, or start a free trial.

Sources: The Hacker News, CISA Known Exploited Vulnerabilities catalogue and NIST National Vulnerability Database.