Critical IBM Aspera Faspex Vulnerability Allows Admin Privilege Escalation
A critical vulnerability in IBM Aspera Faspex, CVE-2026-123218, allows authenticated users to gain administrative privileges, prompting a CISA alert and urgent patching recommendations.
IBM has issued a critical security update for its Aspera Faspex software, addressing a vulnerability that allows authenticated users to escalate their privileges to full administrative control. The flaw, tracked as CVE-2026-123218, affects versions 5.0.0 through 5.0.19 and carries a severe CVSS score of 9.8.
CISA has recognized the severity of this vulnerability by adding it to its Known Exploited Vulnerabilities (KEV) Catalog, with an addition date of November 9, 2026, and a mandatory remediation deadline of November 12, 2026, for federal agencies. While CISA's entry indicates active exploitation, IBM's advisory provides limited details on specific attack campaigns, victims, or exploitation methods beyond the use of a "specially crafted message."
The vulnerability falls under the CWE-863 category, classified as incorrect authorization. In essence, the software fails to properly verify a user's permissions after they have authenticated. While logging in confirms a user's identity, the authorization checks should prevent standard users from performing actions reserved for administrators. This discrepancy is further highlighted by a potential conflict in IBM's advisory, where the description states an attacker must be an authorized user, yet the CVSS vector includes "PR: N" (Privileges Required: None), suggesting no prior authentication might be necessary for exploitation.
Successful exploitation of CVE-2026-123218 grants an authenticated user complete administrative control over the IBM Aspera Faspex application. However, IBM's advisory does not specify the exact technical details of the exploit, such as the affected endpoint, specific message fields, or the precise request required to trigger the flaw. The potential impact on data privacy, integrity, and service availability is rated as high, though the advisory does not confirm the possibility of operating system command execution or root access.
IBM strongly recommends that all affected Linux deployments of Aspera Faspex be upgraded to version 5.0.19 PL1. Crucially, administrators must verify that the faspex-core container image reports version 5.0.19 with the specific build identifier "1ce4b13" and "Fix Pack: 1." Simply checking the main version number may not be sufficient, as the required fix might not be correctly applied. IBM has not provided any workarounds or alternative mitigations for this vulnerability.
This incident underscores the critical importance of thorough patch verification, especially when different patch levels share the same main version number. Defenders must ensure that the exact fixed build is installed to be protected. Organizations should follow IBM's patching instructions diligently and confirm the running container image details to confirm successful remediation.
This authorization bypass vulnerability in IBM Aspera Faspex is distinct from a previously reported issue involving valid sessions remaining active after password changes in a different Aspera product, IBM Aspera Shares. Users should ensure they are applying the correct patches for the specific product and version they are running.