CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog

CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026. The vulnerability affects IBM Aspera Faspex and is an incorrect authorisation flaw that can let an authenticated user bypass authorisation and escalate privileges.

The flaw allows an authenticated user to craft a specific message to bypass authorisation checks. This can enable privilege escalation. The supplied data does not specify a further attack vector or impact. The vulnerability has a CVSS score of 9.8, rated Critical. IBM has made a patch available.

KEV inclusion confirms that the vulnerability is being actively exploited. The data does not establish whether it is used in ransomware campaigns; ransomware use is listed as unknown. CISA’s remediation deadline is 12 November 2026.

CISA requires agencies to apply mitigations in accordance with IBM’s instructions, while complying with applicable BOD 26-04 guidance on prioritising security updates and CISA’s Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and meet the applicable BOD 26-04 patching guidelines.

The direct requirement applies to Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and apply IBM’s available patch or mitigations.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-123218) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.