CVE-2026-123218: CVE-2026-123218: IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific …
Unknown · IBM Aspera Faspex · NVD published 2026-11-07 · posted 2026-11-07 · last modified 2026-11-07
CVE-2026-123218 at a glance
CVE-2026-123218 is a critical-severity Authorization Bypass vulnerability in IBM Aspera Faspex, with a CVSS 3.1 base score of 9.8. NVD published it on 2026-11-07 and classifies the weakness as CWE-863. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-09; the federal remediation due date is 2026-11-12. FIRST EPSS puts the probability of exploitation activity in the next 30 days at 0.40% (percentile 34.1, scored 2026-11-09). NVD does not list a fixed version, so the vendor advisory is the reference for the fix. CVERadar maps 1 MITRE ATT&CK technique across Privilege Escalation, inferred from the CWE and the description. Its CVERadar threat level is 64/100.
What it is
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
| Weakness | CWE-863 definition |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: CNA (us.ibm.com)) |
| CISA due date | 2026-11-12 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Privilege Escalation |
CVERadar report: CVE-2026-123218: flaw exploited in the wild, what we know
What this means for a small business
CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities catalog on 2026-11-09. A KEV listing means CISA has evidence that attackers are using the flaw against real systems, not just that it could be used.
If your business runs IBM Aspera Faspex, put this at the top of the patch list. CISA gave US federal agencies until 2026-11-12 to deal with it, and that is a sensible deadline for a small business too.
- Patch. Install the latest update from the vendor. NVD does not list a fixed version, so the vendor advisory linked on this page is the reference for which release closes it.
- If you cannot patch yet. Follow CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Check your exposure. Find out whether IBM Aspera Faspex can be reached from the internet, for example a VPN portal, an admin login page or a file-transfer site. Your firewall's port-forwarding rules and your IT provider's list of public-facing systems are the quickest places to look. Exposed copies come first.
- When to call IT support. Call your IT support provider now if you run IBM Aspera Faspex and cannot confirm it is updated, if it was reachable from the internet before you patched it, or if you notice accounts, sign-ins or files you do not recognise. The last two can mean the system was already hit, and checking that properly takes someone who can read the logs.
Built from the CISA KEV entry and the NVD record for CVE-2026-123218; nothing here goes beyond those sources.
Exploitation evidence
First exploit evidence seen: 2026-11-09 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2026-11-09. CISA KEV listing
Public exploit code
GitHub proof-of-concept repositories below quality bar
1 public repositories from 1 accounts, first seen 2026-11-10.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: CISA KEV · nomi-sec/PoC-in-GitHub.
Defend the Chain
The attack chain for CVE-2026-123218 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1068 Exploitation for Privilege Escalation Inferred
Inferred from CWE CWE-863
Patches, mitigations and detection
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (source: CISA KEV)
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- Vendor advisory (ibm.com) (CISA KEV notes)
- CISA vendor advisory (cisa.gov) (CISA KEV notes)
- CISA vendor advisory (cisa.gov) (CISA KEV notes)
MITRE ATT&CK mitigations for this chain
- M1051 Update Software (for T1068) : Update software regularly by employing patch management for internal enterprise endpoints and servers.
- M1050 Exploit Protection (for T1068) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
- M1048 Application Isolation and Sandboxing (for T1068) : Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in t
- M1019 Threat Intelligence Program (for T1068) : Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
- M1038 Execution Prevention (for T1068) : Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.
Detection Generic guidance
- Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.