Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-123218 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-07 |
| Vendor | IBM |
| Product | Aspera Faspex |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
IBM Aspera Faspex 5.0.0 through 5.0.19 contains an incorrect authorization flaw (CWE-863). A user with access to the system can craft a specific message that bypasses user authorization checks and thereby gain full administrative privileges. IBM rated the vulnerability CVSS 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Aspera Faspex is used for fast exchange of large files with partners and customers, and its interface is usually exposed to the internet. Taking over an administrator account means access to all packages, user accounts and server configuration.
Required Actions
- Upgrade IBM Aspera Faspex to 5.0.19 PL1 (Linux).
- After upgrading, verify that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1) — container image patching instructions are linked from the IBM bulletin.
- IBM lists no workarounds or mitigations. Until you upgrade, restrict internet access to the Faspex interface (e.g. VPN, IP allowlist) and disable unneeded external accounts.
- Review the list of administrator accounts and permission-change logs for unexpected administrative role grants.
Who Is Affected?
The vulnerability affects organizations running IBM Aspera Faspex 5 (versions 5.0.0–5.0.19) by IBM to exchange large files with partners, customers and branch offices. Deployments where external users (customers, subcontractors) have Faspex accounts are at particular risk.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-123218 vulnerability?
It is an incorrect authorization flaw (CWE-863) in IBM Aspera Faspex 5.0.0–5.0.19. A user with access to the system can send a crafted message, bypass permission checks and gain full administrative privileges. IBM rated it CVSS 9.8 (critical).
How to protect against CVE-2026-123218?
Upgrade IBM Aspera Faspex to 5.0.19 PL1 and verify that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists no workarounds or mitigations.
