IBM Aspera Faspex: an authorization flaw hands users full admin rights, and it is already exploited

What happened

IBM Aspera Faspex is a server application for sending large files quickly. Companies, broadcasters, research institutions and government bodies use it to swap video, backups, engineering documents and contracts with partners and customers. Because outsiders connect to it, the server is usually exposed to the internet.

On 7 November 2026 IBM published a security bulletin for CVE-2026-123218 in Faspex 5. A signed-in user can send a crafted message, get past the permission checks and obtain full administrative privileges. The fix ships in version 5.0.19 PL1. The bulletin does not mention exploitation.

On 9 November 2026 CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and gave federal civilian agencies until 12 November 2026 to remediate it. Three days is far shorter than the usual three weeks, which signals that CISA treats this as urgent. Neither CISA, IBM nor any research team has said who is exploiting the flaw or against whom.

How serious is it

There is an inconsistency in the scoring. The bulletin text, NVD and CISA all describe an authenticated user, yet the vector says PR:N. With PR:L the score would be 8.8, which you can check in our CVSS calculator. That does not make it any less urgent: the flaw is being exploited, and Faspex accounts are routinely handed out to people outside your organisation.

Technical details

IBM classes the bug as CWE-863, Incorrect Authorization. A user with a valid account builds a "specific message" that the application processes without the proper permission check, and in doing so grants themselves admin rights. IBM has not said which part of the application or API is affected, and no technical write-up has appeared yet. As a matter of policy we do not publish exploitation steps.

Why it matters: a Faspex administrator manages users, groups and storage settings and can reach packages. An attacker with those rights can read or download other users' files, create accounts and change configuration. File transfer platforms have been a favourite target for mass data theft before, and Faspex itself was exploited in 2023 through CVE-2022-47986 in the 4.x line (added to KEV on 21 February 2023).

Who is affected

IBM's bulletin lists IBM Aspera Faspex 5.0.0 through 5.0.19 (Linux, container deployment) as vulnerable. Any installation on 5.0.19 or earlier without PL1 is exposed, however few users it has.

The bulletin's metadata also names other Aspera products, such as Faspex On Demand, but only Faspex 5 appears in the affected versions table. If you use a hosted Aspera service, confirm its status with IBM.

How to tell if you were compromised

IBM and CISA have not published indicators of compromise. Until a write-up appears, we at Kyberkit suggest checking:

• the administrator list in Faspex: new admin accounts, or ordinary accounts that recently gained admin rights,
• new user accounts and invitations nobody on your team created,
• unusual downloads: large volumes pulled by a single account, or access to packages the account was not a recipient of,
• configuration changes to storage, authentication and notifications,
• sign-ins from unfamiliar addresses, especially on external partner accounts.

You can pull suspicious IP addresses and domains out of exported logs with our IOC extractor, which runs entirely in your browser.

What to do

1. Upgrade to Faspex 5.0.19 PL1 now. IBM lists no workaround.
2. Confirm the version: after the upgrade, the faspex-core image should report 5.0.19 (1ce4b13, Fix Pack 1).
3. Until the patch is in place, consider limiting access to known partner addresses or a VPN and temporarily disabling accounts you don't need.
4. Review accounts and logs as described above. If you find an unexpected administrator, treat it as an incident: work out which files the account could reach and rotate any passwords and keys stored in the configuration.
5. If you still run Faspex 4, move to the supported 5 line; older versions carry the exploited CVE-2022-47986.
6. Report incidents to your national CERT. In the US you can contact CISA; in the UK, the NCSC.

Timeline

Updates

• 11 November 2026 – first version of this article.