Skip to content
Sign in
CVE-2026-1232189.8Critical

CVE-2026-123218: IBM Aspera Faspex Authorization Bypass

IBM · Aspera Faspex

Vendor fix available · Affected: IBM Aspera Faspex · Exploitation: in CISA KEV since 9 Nov

Action brief

Patch

Evidence

KEV status

In CISA KEV since 9 Nov; federal deadline 12 Nov.

Why this CVE

CISA added it to KEV on 9 Nov. Briefs cover CVEs that CISA added to its Known Exploited Vulnerabilities catalogue in the last 30 days, or that at least 5 outlets covered within 72 hours.

No written summary yet. The sections above come straight from stored records.

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue9 Nov
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not established: not seen
0.4%probability of exploitation in the next 30 days
34th percentile
050100

Higher than 34% of scored CVEs

9.8CriticalCVSS
LowCrit.

Federal deadline

CISA KEV · added 9 Nov · catalogue entry

2d19h8mleft

First in our coverage 9 Nov (CISA), the day CISA added it to KEV.

NowAdded to CISA KEV9 Nov · cisa.govFirst in our coverage9 Nov · CISAFederal deadlineThu 12 Nov, 23:59 UTC
  • In CISA KEV
  • Remediation window
  • Article

DescriptionNVD

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

What changed

  1. CISA added it to the KEV catalogue CISA

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 9 Nov.

Full timeline
Developinglatest 3 hours ago2 articles2 outlets
9 Nov · CISA first10 NovNow
  • Mon 9 Nov, 21:01 UTC. CISA, first report. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
All coveragerunning total2CISA1SecurityOnl…110 NovNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
2 articles about CVE-2026-123218 from 2 outlets
Published (UTC)OutletHeadline
9 Nov 21:01CISACISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog
10 Nov 01:31SecurityOnlineCISA adds four flaws exploited in the wild to its KEV catalog
  1. CISA adds four flaws exploited in the wild to its KEV catalog
    SecurityOnline · mentions it in passing
  2. CISA adds actively exploited IBM Aspera Faspex flaw to KEV catalog
    CISA · official notice · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in