IBM Aspera Faspex Flaw Added to CISA KEV Catalog, Patch Now

CISA has added CVE-2026-123218, a critical authorization-bypass flaw in IBM Aspera Faspex, to its Known Exploited Vulnerabilities (KEV) catalog, confirming the bug is being actively exploited. The flaw lets an already-authenticated user craft a specific request that skips Faspex's authorization checks and hands them full administrative control of the file-transfer platform. IBM rates it CVSS 3.1 9.8 (critical) and has fixed it in Aspera Faspex 5.0.19 PL1; under federal directive BOD 26-04, agencies had until November 12, 2026 to patch, a deadline that has now passed.

What happened

On November 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-123218 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The vulnerability affects IBM Aspera Faspex, the vendor's email-style, drop-box-based file exchange application built on Aspera's high-speed FASP transfer technology. Faspex is widely used by media and broadcast companies, government agencies and enterprises that need to move very large files — video masters, scientific data sets, design files — quickly and reliably between internal teams and outside partners, without relying on general-purpose cloud storage links.

According to the National Vulnerability Database entry, sourced from IBM's own PSIRT, "IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges." In plain terms: an attacker does not need to be anonymous or unauthenticated to pull this off, but they also do not need any special privilege beforehand — any valid, logged-in account on a vulnerable Faspex instance can be turned into a full administrator account through a single malformed request. That makes the bug especially dangerous for Faspex deployments that grant outside partners, vendors or freelancers their own low-privilege accounts purely to drop off or pick up files, since any of those accounts becomes a potential path to full administrative control.

IBM's own PSIRT bulletin, published on its support site, frames the issue the same way: an authenticated user can "craft a specific message to bypass authorization and gain full administrative privileges" over the platform. IBM has not published a narrative timeline of when exploitation began, but CISA's KEV addition on November 9 is itself a statement that the agency had confirmed real-world exploitation by that date.

What is IBM Aspera Faspex

IBM Aspera Faspex is a file-exchange application that sits on top of IBM's Aspera high-speed transfer technology, originally developed by Aspera Inc. and acquired by IBM in 2014. Rather than relying on standard FTP or HTTP transfer speeds, Faspex uses Aspera's FASP (Fast, Adaptive, Secure Protocol) to move very large files at a high percentage of available network bandwidth, which is why it has become a common choice for broadcasters, film and television production, scientific research organizations, and enterprises that exchange multi-gigabyte or multi-terabyte files with outside partners on a regular basis. Users typically interact with Faspex much like an email client: packages of files are "sent" to recipients or deposited in shared drop boxes, with the Aspera transfer engine handling the actual high-speed movement of data in the background. Because Faspex routinely exposes accounts to external vendors, freelancers and partner organizations — not just internal staff — an authorization flaw in its permission model carries outsized risk: the pool of people who can reach the application with at least one valid login is often much larger than the pool of trusted internal administrators.

This is the first time Aspera Faspex has been the subject of a standalone Pandromeda security report; prior coverage of this CISA KEV batch focused on the other three products involved, making CVE-2026-123218 a newly reported angle on an already-disclosed CISA action.

Severity and technical details

NVD lists CVE-2026-123218 with a CVSS 3.1 base score of 9.8 (Critical), using the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means the flaw is remotely exploitable over the network, requires low attack complexity, needs no elevated privileges to start the attack chain, requires no user interaction, and results in a complete loss of confidentiality, integrity and availability for the affected system once exploited.

The underlying weakness is classified as CWE-863, Incorrect Authorization — the application performs an authorization check, but that check can be bypassed through a specially crafted message, rather than being skipped entirely (which would instead be CWE-862, Missing Authorization). CISA's own technical-impact assessment for the bug, recorded in its vulnerability data, rates the result as "total" and the exploitation status as "active," with the flaw also flagged as automatable.

IBM's own security bulletin, published through its PSIRT support pages, confirms the same CVSS vector and score and credits the fix to Aspera Faspex version 5.0.19 PL1 for Linux. IBM's advisory specifically calls out that administrators running Faspex in containers should also confirm their faspex-core container image has been updated to the patched build, since simply patching the host application is not sufficient in containerized deployments.

It is worth separating the authorization bypass from a straightforward authentication bypass. CVE-2026-123218 does not let a completely unauthenticated outsider walk into Faspex — the attacker needs some valid account on the instance first. What makes it critical is that once any account exists, the authorization layer that is supposed to separate ordinary users from administrators can be defeated with a single crafted request, collapsing the distance between "has a login" and "controls the whole platform" to essentially zero.

Who is affected

Per NVD's configuration data, every Aspera Faspex release from 5.0.0 up to and including 5.0.19 is vulnerable; the fix landed in 5.0.19 PL1 (tracked in NVD's CPE matching as version 5.0.19.1). IBM's advisory lists no workaround or mitigation short of upgrading — there is no configuration flag or access-control change that neutralizes the bug without applying the patch.

Any organization running an internet-reachable Faspex instance for partner, vendor or media file exchange should treat this as an immediate priority, since the attack requires only an existing authenticated account on the Faspex server, not administrative access, to escalate all the way to full admin control. That includes deployments where external collaborators — production partners, contractors, distribution vendors — have been issued their own restricted drop-box accounts, since those external, lower-trust accounts are exactly the kind of foothold this vulnerability class is most useful for. On-premises Faspex installations, cloud-hosted instances on IBM Cloud, AWS, Google Cloud or Azure, and containerized deployments are all in scope if they are running an affected version; the vulnerability is in the application layer, not tied to any one hosting model.

The November 9 KEV batch

CVE-2026-123218 was one of four vulnerabilities CISA added to the Known Exploited Vulnerabilities catalog on November 9, 2026, all carrying the same November 12, 2026 remediation deadline under Binding Operational Directive (BOD) 26-04, which requires federal civilian executive branch agencies to remediate catalog entries by their assigned due dates. That window has now closed. The other three flaws in the same batch have already been covered on Pandromeda:

• A loopback-authentication bypass in GPUStack, tracked as CVE-2026-102895, which let remote requests impersonate the built-in administrator.
• A SIP command-injection flaw in SignalWire FreeSWITCH, CVE-2026-116779, exploitable through an inbound chat-protocol message.
• An OpenSSH password-authentication bypass affecting musl-libc systems without PAM, covered in our report on CVE-2026-123158 and Alpine Linux.

Each of those three records is independently verifiable against NVD's own CVE entries for CVE-2026-102895, CVE-2026-116779 and CVE-2026-123158. The table below summarizes all four entries from the batch, each confirmed against NVD's published CVE records.

All four were added to the KEV catalog on the same date with the same November 12, 2026 deadline, but they are unrelated products from different vendors; there is no indication the exploitation campaigns are connected beyond the shared disclosure timing.

How the Faspex flaw is exploited

IBM's advisory and NVD's description both describe the flaw at a functional level without publishing exploit code: an authenticated Faspex user sends a specifically crafted message to the application, and because of the incorrect authorization check (CWE-863), that message bypasses the control that should restrict administrative functions to admin accounts. The result is that the attacker's session gains full administrative privileges over the Faspex instance — access to user accounts, packages, workflows and any configuration an administrator could otherwise reach.

Neither IBM nor NVD has published proof-of-concept details publicly, and this article does not attempt to reconstruct the exact crafted-message format; doing so would only aid attackers. What is confirmed is the authorization class of bug (CWE-863), the score (9.8), and that CISA's addition to KEV is itself confirmation of observed real-world exploitation, since CISA only adds a CVE to the catalog once it has evidence the vulnerability is being actively exploited.

CISA's own vulnerability-tracking data, included in the NVD record, rates the exploitation status "active" and the automatable field "yes," and rates the technical impact of successful exploitation as "total." Those three data points together are a reasonable proxy for how CISA itself assessed the bug when deciding to add it to the KEV catalog: it is being actively used by attackers, it can plausibly be scripted or automated rather than requiring manual, bespoke effort against each target, and a successful attack yields complete control rather than a partial or limited compromise.

How to fix it

IBM's guidance, as reflected in its PSIRT support bulletin, is straightforward: there is no interim mitigation, and administrators should upgrade affected Aspera Faspex deployments to 5.0.19 PL1 as soon as possible. For containerized deployments, IBM specifically notes that patching the host software is not enough on its own — teams need to confirm the faspex-core container image itself has been rebuilt or pulled at the fixed version, since an outdated container image can leave the vulnerability in place even after the surrounding application is updated.

Recommended steps:

• Identify every Aspera Faspex instance in the environment, including any instances exposed to partners, vendors or external collaborators over the internet.
• Confirm the installed version against the 5.0.0–5.0.19 affected range and upgrade to 5.0.19 PL1.
• In containerized or orchestrated deployments, verify the faspex-core image tag/digest matches IBM's patched build rather than only checking the application version reported in the UI.
• Review Faspex user and admin account activity logs for any signs of unexpected privilege escalation events predating the patch, given CISA's confirmation of active exploitation.
• Audit which external accounts — partner, vendor, freelance or contractor logins — currently exist on each Faspex instance, since any of them could have been used as the initial authenticated foothold for this attack.
• Treat internet-facing Faspex instances as a higher priority, consistent with CISA's BOD 26-04 guidance to evaluate each asset's internet exposure when planning remediation.
• After patching, confirm the fix by checking the reported Faspex and faspex-core version strings against IBM's documented 5.0.19 PL1 build identifiers rather than assuming an update succeeded.

Organizations unable to patch immediately should consider CISA's broader BOD 26-04 guidance, which directs agencies to either apply vendor mitigations, follow any applicable cloud-service guidance, or discontinue use of the product if no mitigation is available — a hierarchy that applies just as sensibly to private-sector risk decisions as it does to federal agencies bound by the directive.

Why the KEV catalog and deadline matter

CISA's Known Exploited Vulnerabilities catalog exists to flag vulnerabilities that are not merely theoretical but have confirmed, real-world exploitation. Binding Operational Directive 26-04 requires federal civilian executive branch agencies to remediate catalog entries by the deadline CISA assigns to each one; for this batch, that deadline was November 12, 2026, which has now passed as of this article's publication. The directive does not legally bind private companies, but security teams across industries widely treat KEV additions as a signal of urgency, since the catalog only contains vulnerabilities CISA has verified are being exploited rather than ones that are merely considered high-risk.

For organizations running Aspera Faspex, the practical takeaway is the same regardless of sector: this is not a vulnerability to schedule for a future patch cycle. The combination of a 9.8 CVSS score, no available workaround, and confirmed active exploitation means any vulnerable, internet-reachable instance should be treated as an emergency patch.

What happens next

Expect IBM to continue updating its PSIRT advisory if additional exploitation detail or affected-configuration guidance emerges, and expect further Faspex security bulletins if the same incorrect-authorization issue is found to extend to any related Aspera products. Organizations that have not yet inventoried their Faspex deployments should treat that inventory step as the immediate priority, since the deadline tied to this KEV entry has already passed and any unpatched, internet-facing instance remains an active target. Pandromeda will update this article if IBM or CISA publish further detail on exploitation or on additional affected configurations.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage