IBM · Aspera Faspex
CVE-2026-123218
IBM Aspera Faspex Authorization Bypass
Cos'è
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
CISA: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
Cosa fare
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Scadenza per le agenzie federali USA: 12 novembre 2026
Altre falle sfruttate di IBM
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 21 feb 2023 | Code Execution | Aspera Faspex | Critica 9,8 | >99,9% |
| 4 ago 2026 | Code Injection | Langflow | Critica 9,8 | 29% |
| 25 mag 2022 | Invalid Input | InfoSphere BigInsights | Media 6,5 | 4,8% |
| 10 gen 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critica 9,8 | 98% |
| 3 nov 2021 | Remote Code Execution | Planning Analytics | Critica 10,0 | 86% |
| 3 nov 2021 | Security Bypass | Data Risk Manager | Critica 9,0 | 70% |
| 3 nov 2021 | Remote Code Execution | Data Risk Manager | Critica 9,1 | 62% |
| 3 nov 2021 | Directory Traversal | Data Risk Manager | Media 4,3 | 69% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.