IBM Aspera Faspex

exploitbulletin.com • November 10, 2026

CISA added this flaw to KEV on 2026-11-09 with an unusually short three-day remediation deadline, and Faspex servers not yet on 5.0.19 PL1 are exposed to attackers who can take administrative control of the transfer system and the data it holds.

IBM Aspera Faspex 5.0.0 through 5.0.19 incorrectly enforces authorization, letting a user craft a specific message to bypass authorization checks and gain full administrative privileges on the file-transfer server. IBM rates it CVSS 9.8 and offers no workaround other than upgrading.

Affected: IBM Aspera Faspex 5.0.0 - 5.0.19

Check the running Faspex version: anything in the 5.0.0–5.0.19 range without PL1 is vulnerable; after upgrading, validate that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1). Review Faspex application and access logs for unexpected privilege changes, new or modified administrator accounts, and administrative actions performed by ordinary user accounts.

Upgrade to IBM Aspera Faspex 5.0.19 PL1 (Linux) following IBM's fix instructions; IBM lists no workarounds or mitigations, so if the upgrade must wait, restrict network access to the Faspex server to trusted sources in the interim.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical IBM Aspera Faspex Vulnerability Actively Exploited CISA has warned of active exploitation of a critical vulnerability in IBM Aspera Faspex, tracked as CVE-2026-123218, which allows authenticated users to bypass authorization and gain full administrative privileges. This flaw, rated CVSS 9.8, affects all Faspex 5 versions from 5.0.0 to 5.0.19. IBM released a patch, version 5.0.19 PL1, on November 7, 2026, urging immediate updates. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 9, 2026, indicating evidence of exploitation in the wild. Additionally, the SignalWire FreeSwitch vulnerability, CVE-2026-116779, has also been confirmed as actively exploited, with a similar CVSS score of 9.8. Security professionals are advised to apply the patch promptly to mitigate risks. 6 sources 80

Extracted Entities

IBM Aspera Faspex

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)