CVE-2026-123218

What it is. IBM classifies it as incorrect authorization (CWE-863). Per IBM, a user who is already logged in can send a specially crafted message that skips the server's permission checks and gives that user full administrative rights. IBM does not name the endpoint or the message type, and we found no public technical write-up or exploit code.

A scoring mismatch to know about. IBM's CVSS vector marks the attack as needing no privileges (PR:N), which is what pushes the score to 9.8. IBM's own description and CISA's KEV entry both say the attacker is an authenticated or authorized user. We follow the description, so this page treats a valid Faspex account as a requirement.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on servers your organization owns.

1. Is the server on Faspex 5.0.0 through 5.0.19 without PL1? This decides exposure. IBM's fixed state is the faspex-core container image showing 5.0.19 (1ce4b13, Fix Pack: 1). Anything else in that version range is affected.
2. Can untrusted networks reach the Faspex web interface or API? From a host outside your trusted network, this shows whether the server answers.
   curl -skI https://<faspex-host>/
   A server that answers from the internet goes first.
3. Who holds an account? Faspex is used to exchange files with people outside the organization, so list every account that can log in, including any created for partners, customers or other outside users. The more people who can log in, the more people can use this flaw.

IBM's bulletin lists no workarounds or mitigations. Upgrading to Faspex 5.0.19 PL1 and confirming the faspex-core image shows 5.0.19 (1ce4b13, Fix Pack: 1) is the fix.

IBM and CISA have published no indicators for this CVE as of November 9, 2026.

If you patched late. Patching does not undo an administrator account or permission change an attacker already made. Our reading (Tuskira), not vendor guidance: review Faspex administrator accounts, recent permission changes and new users, and check what packages were sent or downloaded by accounts that gained admin rights.

Is CVE-2026-123218 being exploited?

CISA lists it as known exploited. It added CVE-2026-123218 to the Known Exploited Vulnerabilities catalog on November 9, 2026, with a federal due date of November 12. IBM's bulletin does not mention exploitation, and no one has published details of the attacks.

Does an attacker need a login?

Yes, according to IBM's description and CISA's entry, which both describe an authorized or authenticated user. IBM's CVSS vector says no privileges are required, which conflicts with its own description.

Which version fixes it?

Faspex 5.0.19 PL1 on Linux. IBM says to confirm the faspex-core container image shows 5.0.19 (1ce4b13, Fix Pack: 1).

Is there a workaround?

No. IBM's bulletin lists no workarounds or mitigations.

Is Faspex 4 affected?

IBM's bulletin lists only Faspex 5.0.0 through 5.0.19.

Nov 9, 2026. First published. Fixed in 5.0.19 PL1 since November 7; on CISA KEV since November 9; IBM lists no workaround.

• IBM Security Bulletin 7295921, IBM Aspera Faspex authorization bypass (Nov 7, 2026)
• IBM CNA record for CVE-2026-123218
• NIST NVD: CVE-2026-123218 (Undergoing Analysis, IBM's 9.8 only, checked Nov 9)
• IBM Aspera Faspex 5.0.x documentation
• CISA Known Exploited Vulnerabilities catalog (added Nov 9, 2026; checked the November 9, 2026 catalog release)