CVE-2026-123218

Published Nov 7, 2026

Last updated 2 hours ago

Exploit knownCVSS critical 9.8

Overview

Description
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Source
psirt@us.ibm.com
NVD status
Undergoing Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
IBM Aspera Faspex Incorrect Authorization Vulnerability
Exploit added on
Nov 9, 2026
Exploit action due
Nov 12, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@us.ibm.com
CWE-863

Social media

Hype score
Not currently trending

  1. CISA KEV Catalog adds CVE-2026-123158, CVE-2026-116779, CVE-2026-123218, and CVE-2026-102895 after attackers exploit these four flaws in the wild. #CISA #OpenSSH #FreeSWITCH #Cybersecurity #InfoSec https://t.co/cLYZ0wGOsC

    @Daily_CyberSec

    10 Nov 2026

    121 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 【CISA KEV速報】2026-11-09付けで4件追加 ・CVE-2026-102895 GPUStack ・CVE-2026-116779 SignalWire FreeSwitch ・CVE-2026-123158 OpenBSD OpenSSH ・CVE-2026-123218 IBM Aspera Faspex いずれも悪用確認済み。概要と対応期限はこちら https://t.co/cW31nsty

    @sec_news_com

    9 Nov 2026

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の追加。 - CVE-2026-102895 GPUStack - CVE-2026-116779 SignalWire FreeSwitch - CVE-2026-123158 OpenSSH - CVE-2026-123218 IBM Aspera Faspex 対処期

    @__kokumoto

    9 Nov 2026

    656 Impressions

    0 Retweets

    3 Likes

    2 Bookmarks

    2 Replies

    0 Quotes

  4. 脆弱性情報（11/8時点） ・SonicWall SonicOS（CVE-2026-19868、CVSS 7.1）※悪用確認 ・Keycloak（CVE-2026-120984、CVSS 9.1） ・WordPress LatePoint（CVE-2026-118066、CVSS 9.1） ・IBM Aspera Faspex（CVE-2026-123218、CVSS 9.8） SonicWall

    @nobuakiakita

    8 Nov 2026

    108 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

References

Sources include official advisories and independent security research.