What happened
On November 7, 2026, IBM published a security bulletin for IBM Aspera Faspex, a system companies use to send and receive large files through a web interface. The flaw, tracked as CVE-2026-123218, lets a logged-in user send a specially crafted message, bypass the permission checks and gain full administrator rights.
On November 9, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, the list of vulnerabilities with evidence of real-world attacks. The European Vulnerability Database (EUVD), run by ENISA, lists it as EUVD-2026-118902 and marks it as exploited since November 9, 2026.
According to The Hacker News, there are no public details yet on how the attacks work, who is behind them or how widespread they are. IBM has released a fix in version 5.0.19 PL1 and strongly recommends upgrading now.
Why it is dangerous
This is an “incorrect authorization” flaw (CWE-863). The system checks who you are, but in a certain situation it gets wrong what you are allowed to do. Picture a building where the guard checks your badge at the door, but after that nobody notices when someone with a warehouse pass walks into the CEO’s office.
IBM’s description says the attacker must be a logged-in user. An ordinary account is enough, though, and the attack works over the network, including the internet if Faspex is reachable from outside. At the same time, the CVSS vector IBM itself assigned states that no privileges are required. The safe assumption is that any account, including one belonging to an external partner, may be enough.
Whoever gains administrator rights controls the whole system: they can see and download transferred files, change settings and create new accounts. Since Faspex often carries sensitive documents, contracts or customer data, the main risk is a data leak.
The CVSS score of 9.8 out of 10 under CVSS 3.1 was assigned by IBM itself and means critical severity. CVSS is an international scale that rates how serious a flaw is from a technical point of view.
CISA’s KEV catalog only lists flaws with evidence of real attacks. US federal agencies must fix this one by November 12, 2026. The EPSS score, which estimates the probability of exploitation in the next 30 days, was only 0.4% on November 9, 2026, higher than roughly 34% of scored vulnerabilities. EPSS is just a statistical estimate, however, and confirmed exploitation in KEV takes priority.
Who is affected
IBM Aspera Faspex versions 5.0.0 through 5.0.19 are vulnerable. IBM lists Linux as the platform for the fix, where Faspex 5 runs in containers.
Faspex is used by companies and organizations that exchange large volumes of data with partners, clients or branch offices. If the server is reachable from the internet, for example so that external users can send files to it, the risk is higher.
IBM’s bulletin only lists the Faspex 5 line as vulnerable. In its own classification, IBM also associates the bulletin with services such as IBM Aspera on Demand and IBM Aspera Faspex On Demand. If you use them, check the status with IBM support.
If you don’t use Faspex at all, this flaw does not affect you. Do remember forgotten test installations or systems a supplier manages on your behalf, though.
How to check if you are affected
You can check the version in the Faspex web administration after logging in as an administrator. If you have access to the server, you can also read it from the containers. The following commands change nothing and only display information:
docker ps --format '{{.Names}} {{.Image}}' | grep -i faspexdocker images | grep -i faspex-coreIf you use Podman instead of Docker, replace docker with podman. Version 5.0.19 or lower without Fix Pack 1 is vulnerable. According to IBM, a fixed installation has the faspex-core image at version 5.0.19 (1ce4b13, Fix Pack: 1). If the output does not show the Fix Pack, verify it using the instructions linked from IBM’s bulletin.
Also find out whether the Faspex web interface is reachable from the internet. If it is, updating is your top priority.
How to fix it
IBM fixed the flaw in IBM Aspera Faspex 5.0.19 PL1 for Linux and strongly recommends upgrading now. The vendor lists no workaround or mitigation, so updating is the only real protection.
Recommended steps:
- List every Faspex installation, including test systems, and start with those reachable from the internet.
- Take a backup or snapshot of the server and its configuration before updating.
- Upgrade to version 5.0.19 PL1 following the instructions linked from IBM’s security bulletin.
- After the update, confirm that the
faspex-coreimage is version 5.0.19 (1ce4b13, Fix Pack: 1). - Right after that, check whether the system was compromised, as described in the next section.
If you cannot update right away, IBM offers no official alternative. A sensible general step is to temporarily restrict internet access to Faspex, for example only via VPN or from known IP addresses, or to shut the service down until it is updated. CISA instructs US federal agencies to stop using the product if mitigations are not available.
What if you may already be compromised
Attacks are already happening, but no details about them are public yet, and IBM’s bulletin lists no specific indicators of compromise. Focus on signs that administrator rights were abused:
- unknown administrator accounts or regular accounts that unexpectedly gained higher rights,
- new accounts, API keys or integrations that nobody on your team created,
- changed settings, for example login, notification or storage settings,
- unusual downloads of packages and files, especially from unknown IP addresses or outside working hours,
- suspicious entries in the Faspex container logs, your reverse proxy and your firewall.
docker logs <container_name> 2>&1 | lessIf you find anything suspicious, don’t delete anything and bring in an incident response specialist so the evidence is preserved. If personal data may have leaked, assess your duty to report the incident under GDPR within 72 hours. After cleanup, change administrator passwords and integration keys.