CVE-2026-123218
IBM Aspera Faspex
What this is
IBM Aspera Faspex has a flaw in how it checks what users are allowed to do. A specially crafted message can give a user full administrator rights.
How it can harm you
A user with authorized access can gain full administrator rights in Aspera Faspex, potentially allowing them to read, change or delete data and disrupt the program. Whether signing in is required in every case is unclear.
How urgent it is
This vulnerability is already being used in attacks. Fix it promptly because it can give a user full control over Aspera Faspex.
Who is affected
Aspera Faspex versions 5.0.0 through 5.0.19, inclusive, are affected.
What to do
Consult the IBM advisory for verified remediation and update to a vendor-confirmed release newer than 5.0.19. The affected version limit alone does not identify a fixed release.
How to check your server
Check the installed Aspera Faspex version and compare it with the IBM advisory. Follow its instructions to verify the faspex-core container image and confirm that the correction is installed.
Technical details
- CVE
- CVE-2026-123218
- Published
- November 7, 2026
- CWE
- CWE-863
- CVSS
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.5% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed; public exploit on GitHub
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.