SockAnalystIBM Aspera Faspex 5 CVE-2026-123218: logged-in users can make themselves full admins, CISA says it is exploited
SockAnalyst · Security+ certified analyst.
What happened
IBM published a security bulletin on November 7, 2026 for CVE-2026-123218 (CVSS 9.8, IBM), an incorrect-authorization flaw (CWE-863) in IBM Aspera Faspex 5. IBM says an authorized user can craft a specific message to bypass user authorization and gain full administrative privileges. IBM fixed it in Faspex 5.0.19 PL1 and lists no workaround. CISA added it to the Known Exploited Vulnerabilities catalog on November 9 with a November 12 federal deadline. IBM's bulletin does not mention exploitation, and no attack details, actor or technical write-up are public. Note that IBM's CVSS vector says no privileges are required while its description and CISA say an authenticated user, so treat any valid Faspex account, including partner or customer accounts, as enough.
Who's affected
Organizations running IBM Aspera Faspex 5.0.0 through 5.0.19 without PL1 on Linux. Faspex is used to exchange files with outside parties, so servers with many external accounts and an internet-reachable web UI or API are the highest risk.
✅ Fix / patch
- Upgrade to IBM Aspera Faspex 5.0.19 PL1 per IBM's bulletin. As root run faspexctl setup to pull patched images, then faspexctl version and confirm faspex-core shows 5.0.19 (1ce4b13, Fix Pack: 1).
- IBM lists no workarounds or mitigations, so patching is the only fix. Federal agencies must remediate by November 12, 2026 under the KEV listing.
- Until patched, limit who can reach the Faspex web interface and API from untrusted networks and disable accounts that are no longer needed.
- After patching, review administrator accounts, privilege changes, and sharing or transfer configuration changes for anything your team did not make.
🔎 Quick hunt check
No IOCs have been published by IBM or CISA. Hunt for Faspex accounts that newly gained administrator rights, admin actions by users who are not known admins, and unusual logins to the Faspex web UI or API from external IPs.
MITRE ATT&CK: T1078, T1068, T1098
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
(index=web OR index=proxy OR index=app) (host="*faspex*" OR dest_host="*faspex*" OR uri_path="/aspera/faspex*")
| search (uri_path="*/admin*" OR uri_path="*/users*" OR uri_path="*/roles*" OR uri_path="*/accounts*") (http_method=POST OR http_method=PUT OR http_method=PATCH)
| stats count min(_time) as first max(_time) as last values(uri_path) as paths values(status) as status by user, src_ip
| where count>0
// Admin and user-management writes on Faspex; flag any user or source not on your known-admin list (CVE-2026-123218 privilege escalation)let knownAdmins = dynamic(["replace-with-your-faspex-admins"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has "faspex"
| where RequestURL has_any ("/admin","/users","/roles","/accounts") and RequestMethod in~ ("POST","PUT","PATCH")
| where SourceUserName !in (knownAdmins)
| summarize Hits=count(), First=min(TimeGenerated), Last=max(TimeGenerated), URLs=make_set(RequestURL, 20) by SourceUserName, SourceIP
// Faspex admin or user-management writes by accounts outside your admin list: possible CVE-2026-123218 escalation⏱ CISA deadline
Sources
- IBM Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass (CVE-2026-123218)
- CISA KEV catalog: CVE-2026-123218 added November 9, 2026 (due November 12)
- SecurityWeek: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
- The Hacker News: CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
Related playbooks
- Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited · Exploited vuln · 2026-11-10
- Openwave Webtop Media Transcoder CVE-2026-111793: file-type restriction bypass exploited, on CISA KEV (due Nov 24) · Exploited vuln · 2026-11-12
- Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways · Exploited vuln · 2026-11-13
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free