CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities catalog on 9 November 2026 as 'IBM Aspera Faspex Incorrect Authorization Vulnerability', saying an authenticated user could craft a specific message to bypass authorization, causing privilege escalation; the US federal due date is 12 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)

IBM's security bulletin (initial publication 7 November 2026) says IBM Aspera Faspex 5 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges (CWE-863). IBM scores it CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected: IBM Aspera Faspex 5.0.0 to 5.0.19; fixed in 5.0.19 PL1 (Linux; faspex-core container image 5.0.19, 1ce4b13, Fix Pack 1).

IBM lists no workarounds or mitigations. (source: IBM Security Bulletin)