IBM · Aspera Faspex
CVE-2026-123218
IBM Aspera Faspex Authorization Bypass
What it is
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
CISA: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Deadline for US federal agencies: November 12, 2026
More exploited flaws from IBM
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 21, 2023 | Code Execution | Aspera Faspex | Critical 9.8 | >99.9% |
| Aug 4, 2026 | Code Injection | Langflow | Critical 9.8 | 29% |
| May 25, 2022 | Invalid Input | InfoSphere BigInsights | Medium 6.5 | 4.8% |
| Jan 10, 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Critical 9.8 | 98% |
| Nov 3, 2021 | Remote Code Execution | Planning Analytics | Critical 10.0 | 86% |
| Nov 3, 2021 | Security Bypass | Data Risk Manager | Critical 9.0 | 70% |
| Nov 3, 2021 | Remote Code Execution | Data Risk Manager | Critical 9.1 | 62% |
| Nov 3, 2021 | Directory Traversal | Data Risk Manager | Medium 4.3 | 69% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.