What happened
IBM Aspera Faspex is affected by CVE-2026-123218, an incorrect authorisation vulnerability that could allow a specially crafted message to bypass authorisation and cause privilege escalation. CISA KEV lists the vulnerability as actively exploited in the wild. The reported detail says an authenticated user can craft the message, while the attack-condition data and CVSS vector specify that no prior access or user interaction is required. These supplied facts differ on the prior-access condition. The stated attack path is a direct network attack against an exposed service. The vulnerability is rated critical, with an NVD score of 9.8. Its CVSS vector records high impact to confidentiality, integrity and availability. The weakness is classified as CWE-863.
Who is affected
IBM Aspera Faspex versions 5.0.0 to 5.0.19 are affected. Organisations running these versions with a service exposed to network attack are within the stated attack path. Exploitation has been confirmed and is listed on CISA KEV.
Recommended actions
- Restrict network exposure of affected Faspex services to reduce the opportunity for direct attacks against exposed services.
- Segment affected deployments and place access controls in front of the service to limit network access, in line with the stated attack path.
- Check the vendor advisory for fixed versions, then apply the vendor’s mitigations or updates applicable to affected deployments.
