Is your IBM Aspera Faspex server exposed to CVE-2026-123218?
IBM's bulletin for CVE-2026-123218 says an authorized user can bypass authorization and gain full administrative privileges on Aspera Faspex. Affected versions are 5.0.0 through 5.0.19. The fix is 5.0.19 PL1, with faspex-core 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists no workarounds. The bulletin does not mention exploitation; CISA has added it to KEV. Patch now.
In CISA KEV. An authenticated user can become admin. Patch to 5.0.19 PL1
IBM's bulletin (initial publication 7 November 2026) describes an authorization bypass that an authenticated, authorized user can use to gain full administrative privileges. CISA added CVE-2026-123218 to the Known Exploited Vulnerabilities catalogue on 9 November 2026, with a due date of 12 November 2026, and forensicTriage Yes. That due date binds US federal agencies only. Our advice, for everyone, is to apply 5.0.19 PL1 now. This is not a 'no account needed' issue; IBM's written description requires an authenticated user, even if the CVSS vector lists PR:N.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.
At a Glance
Based on IBM's official bulletin and CISA KEV catalogue 2026.11.10, rechecked at 22:27 GMT on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.
IBM CVSS 9.8
IBM scores it 9.8 (CWE-863, incorrect authorization). The CVSS vector lists PR:N; we follow IBM's written description, which requires an authenticated user.
In CISA KEV
Added 9 November 2026, due 12 November 2026 (US federal agencies only). forensicTriage: Yes. The IBM bulletin itself does not mention exploitation.
Faspex 5.0.0 to 5.0.19
IBM's bulletin: 5.0.0 through 5.0.19. Any authenticated account, including a low-privilege one, is in scope.
5.0.19 PL1
Linux. Validate faspex-core 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists workarounds: None.
IBM publishes the security bulletin for CVE-2026-123218. Initial publication date on the bulletin is 7 November 2026. Affected: 5.0.0 to 5.0.19. Fix: 5.0.19 PL1. Workarounds: None.
CISA adds CVE-2026-123218 to KEV, due 12 November 2026, forensicTriage Yes. That due date binds US federal agencies only.
Still in KEV catalogue 2026.11.10 (released at 19:03 UTC). The IBM bulletin still does not mention exploitation.
Apply 5.0.19 PL1, confirm faspex-core 5.0.19 (1ce4b13, Fix Pack: 1), and hunt for unexpected admin activity.
Authenticated, not unauthenticated
IBM's summary describes an authenticated user, and the description says an authorized user can gain full administrative privileges. CISA's KEV short description also says an authenticated user. The IBM CVSS vector lists privileges required as none (PR:N). We follow the written description: an account is required, even a low-privilege one. Do not describe this as needing no account.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Apply 5.0.19 PL1
- IBM: upgrade affected Faspex 5.0.0 through 5.0.19 to 5.0.19 PL1. IBM lists no workarounds.
- Our advice: confirm faspex-core 5.0.19 (1ce4b13, Fix Pack: 1), not the 5.0.19 product string alone.
- Our advice: inventory every Faspex instance, including lab and contractor systems.
- Our advice: review who can authenticate to Faspex, because any authenticated account is in scope until you are patched.
Hunt and contain
- Our advice: review Faspex admin changes and unexpected privilege grants from before the upgrade.
- Our advice: look for unexpected calls to admin API paths, and for unusual download or transfer activity.
- Our advice: look for unexpected shells in Faspex containers, and for unexpected file changes on the host.
- Our advice: if you find signs of misuse, isolate the service, keep the logs, apply 5.0.19 PL1, and rotate Faspex credentials.
Proactive: Vendor Steps, Then Ours
IBM's bulletin first. CybaVerse advice is labelled separately.
Apply 5.0.19 PL1
IBM's security bulletin says Faspex 5.0.0 through 5.0.19 is affected, and that 5.0.19 PL1 on Linux is the fix. It lists workarounds: None. Validate the running faspex-core is 5.0.19 (1ce4b13, Fix Pack: 1).
Inventory every instance
Find every Faspex 5.x install, including those run for clients or in lab environments. Record the faspex-core string, not only the marketing version.
Run the checker
Capture faspexctl version yourself and point the pack checker at that file, or pass the faspex-core string. The checker only marks 5.0.19 PATCHED when the build is 1ce4b13.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-faspex.sh
Read-only offline checker. Point it at a faspexctl version capture, a faspex-core string, or an inventory CSV. It never contacts Faspex. A 5.0.19 install is only PATCHED when the build is 1ce4b13 (Fix Pack 1).
faspexctl version > faspexctl-version.txt
bash check-faspex.sh --version-file faspexctl-version.txt --host fx01
bash check-faspex.sh --core "5.0.19 (1ce4b13, Fix Pack: 1)" --host fx01
bash check-faspex.sh --csv inventory.csvCheck-Faspex.ps1
The same checks in PowerShell 7, with identical output and exit codes.
pwsh -File Check-Faspex.ps1 -VersionFile faspexctl-version.txt -HostName fx01
pwsh -File Check-Faspex.ps1 -Csv inventory.csvKQL and Sigma
11 KQL hunts for Microsoft Sentinel and Defender (Q1 to Q1c inventory and version; Q2 and Q2b admin API paths; Q3 and Q3b admin API writes; Q4 and Q4b download or transfer activity; Q5 container shells; Q6 file changes). 5 Sigma rules cover the same ground, with Kusto conversions included. None of the KQL has been run against a live tenant yet. IBM has published no indicators of compromise.
Verdicts
- PATCHEDfaspex-core 5.0.19 build 1ce4b13 (Fix Pack 1).
- VULNERABLEfaspex-core 5.0.0 to 5.0.18, or 5.0.19 without build 1ce4b13 or Fix Pack 1.
- UNKNOWNNo readable faspex-core version, or 5.0.19 with Fix Pack 1 but a build other than 1ce4b13.
- NOT AFFECTEDVersion outside IBM's 5.0.0 to 5.0.19 range.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED |
| 1 | VULNERABLE |
| 2 | UNKNOWN |
| 3 | NOT AFFECTED |
| 5 | Usage or read error |
Confirm faspex-core 5.0.19 (1ce4b13, Fix Pack: 1), not the marketing 5.0.19 string alone. The full pack zip contains 31 files.
What is in the pack
| File | What it does |
|---|---|
| check-faspex.sh | Offline checker for Linux and macOS (bash) |
| Check-Faspex.ps1 | The same checker in PowerShell 7 |
| KQL (11 hunts) | Microsoft Sentinel and Defender hunts Q1 to Q6 |
| Sigma (5 rules) | Web, Linux process and file rules, plus Kusto conversions |
| tests/ | Fixtures and tests |
| README.md | Verified facts, IBM vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
IBM has published no indicators of compromise. The hunts below are CybaVerse advice. CybaOps can run them across your estate.
Admin privilege changes
Review Faspex audit and admin activity for unexpected elevation to administrative privileges, including from low-privilege accounts, before and after you apply 5.0.19 PL1.
Admin API and transfer paths
Look for unexpected requests to admin API paths and for unusual download or transfer activity (pack hunts Q2 to Q4b).
Host and container artefacts
Look for unexpected shells in Faspex containers (Q5) and unexpected file changes on the Faspex host (Q6).
If you find signs of compromise (our advice)
- Isolate the Faspex service and keep its logs and a disk or container image.
- Apply 5.0.19 PL1 and confirm faspex-core 5.0.19 (1ce4b13, Fix Pack: 1).
- Rotate Faspex credentials, including admin, API and integration accounts, and credentials for users who could authenticate.
- Review recent transfers and packages for unauthorised access.
- Start incident response if Faspex holds sensitive content.
IBM Aspera Faspex CVE-2026-123218 FAQ
Short answers based on IBM's official bulletin and CISA KEV, rechecked on 10 November 2026.
What is CVE-2026-123218?
IBM's bulletin says IBM Aspera Faspex has addressed a vulnerability that could allow an authorization bypass. The description is that an authorized user can craft a specific message to bypass authorization and gain full administrative privileges. The CWE is CWE-863 (incorrect authorization). Initial publication: 7 November 2026.
Does an attacker need an account?
Yes. IBM's written summary and description, and CISA's KEV short description, all say an authenticated or authorized user. Any authenticated account, including a low-privilege one, is in scope. The IBM CVSS vector lists PR:N, which conflicts with that prose. We follow the written description and do not describe this as needing no account.
Which versions are affected, and what is the fix?
Affected: Faspex 5.0.0 through 5.0.19. Fix: 5.0.19 PL1 (Linux). Confirm faspex-core 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists workarounds: None.
Is it in CISA KEV, and is IBM saying it is exploited?
It is in CISA KEV, added 9 November 2026, due 12 November 2026, forensicTriage Yes, ransomware use Unknown. That due date binds US federal agencies only. Our advice is to apply 5.0.19 PL1 now. The IBM bulletin itself does not mention exploitation; the KEV listing is CISA's.
How severe is it?
IBM scores it CVSS 9.8. We report IBM's score and do not invent a different one.
Who is this relevant to?
Organisations that run IBM Aspera Faspex 5.x, including managed or hosted file-exchange services used to send large files.
Protect Your File Transfer Platform, and Your Customers'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- IBM Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow an authorization bypass (initial publication 7 November 2026)
- CVE record: CVE-2026-123218
- CISA: Known Exploited Vulnerabilities catalogue (CVE-2026-123218 added 9 November 2026; catalogue 2026.11.10 rechecked 10 November 2026, 22:27 GMT)
Related threat guides: FreeSWITCH CVE-2026-116779 and Chrome CVE-2026-125350. All threat guides.