CVE-2026-123218 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-07

Added to CISA KEV: 2026-11-09 2 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Upgrade IBM Aspera Faspex to version 5.0.19 PL1 (Fix Pack 1) as directed by IBM advisory. Validate the faspex-core container image hash is 5.0.19 (1ce4b13, Fix Pack: 1). Follow instructions at https://www.ibm.com/docs/en/aspera-faspex/5.0.x
URGENT: If immediate patching is not feasible, restrict access to the Faspex web interface to known trusted IP ranges using firewall ACLs or network-level controls. Remove or disable unnecessary user accounts.
INVESTIGATE: Review Faspex administrative audit logs for any unexpected privilege escalation events, new admin account creation, or unauthorized configuration changes — particularly for events occurring since version 5.0.0 was deployed.
MONITOR: Implement alerting on any new administrator account creation or privilege changes within Faspex. Monitor for unusual API request patterns or crafted messages targeting authorization endpoints.
REVIEW: Audit all current Faspex user accounts. Remove accounts for users who no longer require access. Apply least-privilege principles to all existing accounts.
THREAT INTEL: Monitor CISA KEV and threat intelligence feeds for this CVE being added to active exploitation lists. Given the product's history (CVE-2022-47986 ransomware exploitation), treat this as a high-priority patch even without confirmed active exploitation.
PATCH PRIORITY: CRITICAL — patch within 24–72 hours for all internet-facing deployments. The combination of CVSS 9.8, internet-facing deployment pattern, and the product's known attractiveness to ransomware operators warrants emergency change procedures.

🔍 Web Intelligence (Kagi · 2026-11-09)

Summary

CVE-2026-123218 is a critical incorrect authorization vulnerability (CWE-863) affecting IBM Aspera Faspex versions 5.0.0 through 5.0.19. The flaw allows an already authorized user to craft a specially designed message that bypasses standard authorization controls, enabling them to escalate privileges and gain full administrative access to the system. This vulnerability is significant because it permits unauthorized system configuration changes and broad data access, posing a major security risk for organizations managing high-value file transfers.

Exploitation

Active Exploitation: There are currently no reports of this vulnerability being actively exploited in the wild.
Threat Actors/Ransomware: No specific threat actors or ransomware campaigns have been linked to this vulnerability at this time.
Exploit Availability: As of now, there are no public proof-of-concept (PoC) exploits or automated exploit tools widely available.
Attack Prerequisites: The attack can be carried out remotely, does not require user interaction, and, while the attacker must be an authorized user to initiate the sequence, it does not require administrative privileges beforehand.

Affected Products & Patches

Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.19 are vulnerable.
Patch Availability: IBM has issued a security update to address this issue; users are strongly advised to upgrade to the patched version of IBM Aspera Faspex.
Mitigations: If an immediate upgrade is not feasible, organizations should restrict access to the affected services to trusted users only and monitor for anomalous administrative activity within the application.

Impact

Access/Capability: Successful exploitation grants an attacker full administrative privileges within the IBM Aspera Faspex environment.
Business Risk: For internet-facing deployments, this risk is severe, as it allows attackers to bypass security boundaries to modify critical system configurations, intercept or manipulate sensitive file transfers, and potentially pivot into deeper internal network segments, leading to significant data breaches or operational disruption.