CVE-2026-123218: IBM Aspera Faspex Authorization Bypass

Published Nov 7, 2026

Updated

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Aspera Faspex to a version that resolves this vulnerability.
Fixed in 5.0.19Patch PL1

Event History

Nov 7, 2026

CVE Published

via MITRE·03:47 AM

Data Sourced

via MITRE·03:47 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authorized IBM Aspera Faspex user can exploit it. The issue is not described as unauthenticated; the attacker must be able to craft a specific message.

Which versions are affected?

IBM Aspera Faspex versions 5.0.0 through 5.0.19 are affected.

What level of access can an attacker obtain?

Successful exploitation allows the authorized attacker to bypass user authorization and gain full administrative privileges.

CVE-2026-123218: IBM Aspera Faspex Authorization Bypass

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

What level of access can an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

What level of access can an attacker obtain?