IBM Aspera Faspex CVE-2026-123218 Exploited: CISA Lists the Admin Takeover Flaw and Gives Agencies Three Days

Attackers are using an admin-takeover flaw in IBM Aspera Faspex, IBM's server for sending large files to outside partners, and CISA confirmed it two days after IBM shipped the fix. CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities catalogue on 9 November and gave US federal agencies until 12 November to fix it. The CVE record says a crafted message lets a user "bypass user authorization and gain full administrative privileges".

What IBM disclosed

IBM's bulletin went out on 7 November and covers Faspex 5.0.0 through 5.0.19. Its wording says the attacker is "an authorized user", yet IBM's own score of 9.8 uses a vector with no privileges required. The bulletin doesn't say which reading is right.

CISA's entry in the CVE record marks exploitation as "active" and the attack as automatable. Its catalogue gives ransomware use as "Unknown", and neither CISA nor IBM has said who is behind the attacks or how many servers were hit.

Faspex was on CISA's list once before, for CVE-2022-47986 in the 4.x line, which drew a 2023 alert from CSA Singapore.

The same KEV update

CISA listed three other flaws that day. Two are covered separately: the OpenSSH password bypass on Alpine Linux and the FreeSWITCH SIP message flaw. The third, in the GPUStack AI cluster manager, is fixed in GPUStack 2.2.0.

Fixed version

Upgrade Linux installs to Faspex 5.0.19 PL1; for container deployments, pull the fixed images using the steps in IBM's bulletin.

A patched install reports the faspex-core container image as 5.0.19 (1ce4b13, Fix Pack: 1). The bulletin lists no workaround.