CISA Adds IBM Aspera Faspex Vulnerability to Actively Exploited Catalog
CISA lists CVE-2026-123218 in IBM Aspera Faspex in its KEV catalog. IBM has released a fix and lists no alternative mitigation.
The IBM Aspera Faspex vulnerability identified as CVE-2026-123218 was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026. The entry means exploitation in the wild has been confirmed. IBM rates the vulnerability 9.8 out of 10 on the CVSS scale and recommends deploying the available fix.
This is an authorization flaw. According to IBM, successful exploitation could allow an attacker to bypass authorization and obtain full administrative privileges.
The IBM Aspera Faspex vulnerability affects version 5.0
IBM says that Aspera Faspex versions 5.0.0 through 5.0.19 are affected. A fix is available in version 5.0.19 PL1 for Linux. Operators should also verify that they are using the faspex-core container image version 5.0.19 with build 1ce4b13, identified as Fix Pack 1.
For CVE-2026-123218, IBM lists no workaround or mitigation and recommends deploying the available fix.
KEV confirms exploitation, not attack details
Neither CISA nor IBM has published technical details about the exploitation, its scope, the attacker’s identity, or the specific organizations targeted. It is therefore not possible to determine which environments have already been compromised. The CISA entry also does not identify the vulnerability as being used in ransomware campaigns.
Uncertainty around access requirements
Available information differs in its description of the attack conditions. CISA’s description states that an authenticated user is required. However, IBM used the PR:N metric in its CVSS assessment, indicating that no privileges are required. Operators should verify the attack conditions in their own deployments and monitor for any clarification from IBM.
The priority should be identifying the versions in use, deploying version 5.0.19 PL1 on Linux systems, and verifying the faspex-core image version in container environments. Systems accessible from the internet deserve particular attention, as IBM states that obtaining full administrative privileges is possible.
Further information may come from any indicators of compromise, forensic recommendations, or technical analysis of the attack. Any clarification from IBM of the discrepancy between the authentication description and the CVSS metric will also be important.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-123218 was added to KEV on November 9, 2026, the recorded exploitation, and the recommendation to follow the vendor’s instructions.
- IBM Security Bulletin – Confirms the affected versions, impact description, CVSS 9.8 rating, 5.0.19 PL1 fix, and absence of a workaround.
Verified and updated: 11/10/2026 06:26
