IBM Aspera Faspex flaw gives any user full admin rights, exploited

On 7 November 2026, IBM published a security bulletin for CVE-2026-123218, an authorisation bypass in IBM Aspera Faspex 5, its file transfer server. IBM says an authorised user can send a specially crafted message to bypass user authorisation and gain full administrative privileges. IBM's bulletin does not mention exploitation. On 9 November, CISA added the flaw to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation.

The bugs

CVE-2026-123218, incorrect authorisation. It affects IBM Aspera Faspex 5.0.0 through 5.0.19. IBM scores it 9.8 (critical).

IBM's description says the attacker must already be an authorised user. However, its CVSS vector says no privileges are needed, and IBM does not explain the difference. Anyone with a Faspex account should be treated as a possible attacker. If your server allows self-registration or external accounts, the flaw may be within reach of outsiders.

Full administrative access to a Faspex server means control over its settings, its users and the files that pass through it.

The remedy

Upgrading is the fix. IBM strongly recommends upgrading now:

• IBM Aspera Faspex on Linux: 5.0.19 PL1 (also listed as 5.0.19.1)

After upgrading, check that the faspex-core container image shows 5.0.19 (1ce4b13, Fix Pack: 1), as IBM instructs.

Because CISA lists the flaw as exploited, also review the server for signs of misuse. Look for administrator accounts you did not create, unexpected configuration changes and unusual file access. Remove anything unauthorised, and reset passwords and credentials for administrator accounts.

If you cannot update today

IBM lists no workarounds or mitigations, so nothing makes an unpatched server safe. Until you can upgrade, reduce exposure:

• Limit network access to the Faspex web interface and API to trusted users and networks.
• Disable accounts that are not needed.
• Watch closely for new administrators or changes to privileges.

Upgrade to 5.0.19 PL1 as soon as you can.

Sources

• IBM Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass
• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog