CISA Confirms Exploitation of IBM Aspera Faspex Authorization Bypass
Tech GuruQuick Answer
Investigate Faspex 5.0.0–5.0.19, preserve authorization and administrative activity evidence, and apply 5.0.19 PL1. Verify faspex-core build 1ce4b13, Fix Pack 1, after the supported update.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify Faspex hosts, container image versions, fix-pack level, user roles, exposure and file-transfer owners. Match Faspex 5.0.0 through 5.0.19 to IBM’s bulletin. IBM describes an authenticated-user prerequisite although its supplied CVSS vector uses PR:N; do not infer unauthenticated exploitation from the score. Follow IBM’s supported Linux upgrade instructions for 5.0.19 PL1. IBM lists no workaround; restrict administrative exposure while arranging the update. Verify the faspex-core image and fix-pack marker, test authorized transfers and access controls, review unexpected role or administrator changes, and retain relevant logs and update evidence.
Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | IBM Aspera Faspex 5 on Linux |
|---|---|
| Advisory | IBM-7295921 / CISA-KEV-CVE-2026-123218 |
| CVE | CVE-2026-123218 |
| CISA KEV addition and catalog release | November 9, 2026 (KEV addition); catalog released at 2026-11-09T19:54:37.4945Z. |
| Authority revision date | IBM bulletin initially published November 7, 2026; no later substantive revision stated. The new event is CISA KEV inclusion. |
| Affected versions | IBM Aspera Faspex 5.0.0 through 5.0.19. IBM describes an authenticated user crafting a message to bypass authorization and gain administrative privileges. |
| Fixed version | IBM Aspera Faspex 5.0.19 PL1; faspex-core 5.0.19 (1ce4b13, Fix Pack: 1) |
| CVSS base score | 9.8 (IBM CVSS v3.1 base score) |
| CVSS severity | Not provided by the authority |
| Exploitation status | CISA confirms exploitation through its November 9, 2026 KEV addition. Ransomware campaign use is Unknown.; no exploitation claim is inferred. |
What Changed
CISA added the Faspex authorization bypass to KEV on November 9, after IBM issued its November 7 bulletin. The new catalog entry confirms exploitation and flags forensic triage. IBM provides a Linux fix pack and no workaround.
What To Validate Now
- Inventory. Identify Faspex hosts, container image versions, fix-pack level, user roles, exposure and file-transfer owners.
- Establish applicability. Match Faspex 5.0.0 through 5.0.19 to IBM’s bulletin. IBM describes an authenticated-user prerequisite although its supplied CVSS vector uses PR:N; do not infer unauthenticated exploitation from the score.
- Remediate. Follow IBM’s supported Linux upgrade instructions for 5.0.19 PL1. IBM lists no workaround; restrict administrative exposure while arranging the update.
- Validate. Verify the faspex-core image and fix-pack marker, test authorized transfers and access controls, review unexpected role or administrator changes, and retain relevant logs and update evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CISA lists a November 12, 2026 due date and forensic triage requirement. Federal readers should check applicable directive obligations; other organizations should use their governing response process. Coordinate transfer availability and evidence preservation before changes.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
