IBM Aspera Faspex 5: any signed-in user can take admin rights. Install 5.0.19 PL1 before Thursday

IBM Aspera Faspex is the file-transfer server many media, engineering and life-sciences teams use to exchange large files with clients. IBM fixed a bug on November 7 that lets any signed-in user craft a request and take full administrator rights. Two days later CISA added it to its exploited list, with a Thursday, November 12 deadline.

IBM lists no workaround. The fix is Faspex 5.0.19 PL1.

A Faspex 5 bug turns any user into an admin, and CISA says it is being exploited. IBM’s only fix is 5.0.19 PL1.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Any Faspex 5 account can become an administrator

CVE-2026-123218 is an incorrect-authorization flaw. IBM’s bulletin says Faspex 5 “could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.” IBM scores it CVSS 9.8.

CISA added the bug to the KEV catalog on November 9 and flagged it for forensic triage. Neither IBM nor CISA has published attack details or indicators.

• Affected: IBM Aspera Faspex 5.0.0 through 5.0.19.
• Fixed: 5.0.19 PL1 on Linux. IBM says to confirm the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1).
• Workarounds: none.

Teams that swap large files with clients through Faspex

Faspex accounts are easy to come by. Many servers give logins to outside clients, freelancers and partners so they can send packages, and every one of those accounts is a path to admin on a vulnerable build. An admin can read every package on the server, change users and reroute deliveries.

Faspex has been a target before. CISA added the Faspex 4 code-execution bug CVE-2022-47986 to its exploited list in February 2023.

Install Faspex 5.0.19 PL1 and check the container build

• Find every Faspex 5 server and check its version. Anything from 5.0.0 to 5.0.19 without PL1 is exposed.
• Upgrade to 5.0.19 PL1 following IBM’s instructions, then confirm the faspex-core image shows 5.0.19 (1ce4b13, Fix Pack 1).
• Until it is patched, take the admin interface off the open internet and disable outside accounts that do not need access this week.
• After the upgrade, review the admin list and recent permission changes, and remove anything you cannot explain.

Details

• CVE-2026-123218: IBM Aspera Faspex 5 incorrect authorization (CWE-863); an authorized user can gain full administrative privileges. CVSS 9.8 (IBM).
• Affected / fixed: 5.0.0 through 5.0.19; fixed in 5.0.19 PL1 (faspex-core 5.0.19, 1ce4b13, Fix Pack 1). Bulletin first published November 7, 2026.
• KEV: added November 9, 2026; federal due date November 12, 2026; forensic triage flagged.
• History: Faspex 4 CVE-2022-47986 joined KEV on February 21, 2023.

Hunt / verify

• Export Faspex audit logs since late October and list every role or permission change to admin.
• Compare current admin accounts with the people who should hold them.
• Review packages downloaded or forwarded by accounts that rarely log in, and new external users created in November.
• Check the container image tag on every node after the upgrade; a node left on the old image is still exposed.

Source: IBM security bulletin: Aspera Faspex CVE-2026-123218; CISA KEV alert, November 9

Sources

• IBM: Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass
• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (November 9, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• CVE.org: CVE-2026-123218
• NVD: CVE-2026-123218

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].