CVE-2026-123218 is a critical (CVSS 9.8) authorization flaw in IBM Aspera Faspex 5.0.0 through 5.0.19. According to IBM, it "could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges."
What Is It
IBM published CVE-2026-123218 on November 7, 2026. IBM's description says that IBM Aspera Faspex 5.0.0 through 5.0.19 "could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges."
The weakness is classified as CWE-863 (Incorrect Authorization). NVD lists the record as "Awaiting Analysis," so NVD has not yet published its own enrichment of IBM's data.
Why It Matters
IBM's CVSS v3.1 base score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Impact: High confidentiality, integrity, and availability
The written description and the score do not quite agree. The description says the attacker is an "authorized user," but the vector says no privileges are required (PR:N). Defenders should not assume that requiring authentication limits exposure. Under either reading, IBM's description says a successful attack could give the attacker full administrative control of the Faspex instance.
Aspera Faspex is used to exchange files. Administrative access to it could expose the files and accounts it manages.
Exploitation status: CVE-2026-123218 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing. The supplied sources do not confirm active exploitation, and no KEV remediation deadline applies.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | Aspera Faspex | 5.0.0 through 5.0.19 (inclusive) |
IBM's record marks all other versions as unaffected by default. NVD has not yet published CPE data for this CVE.
Patch Status
The supplied NVD data does not name a fixed version or specific remediation steps. IBM has published a security bulletin for this vulnerability (linked below). Organizations running Aspera Faspex 5.0.0 through 5.0.19 should:
- Read the IBM bulletin for the fixed release and upgrade instructions
- Treat this as a priority update, given the critical score and the potential for full administrative compromise
- Track the CISA KEV catalog in case active exploitation is confirmed later