# IBM Aspera Faspex: exploited authorization flaw requires PL1

Canonical: https://www.oktsec.com/radar/ibm-aspera-faspex-cve-2026-123218
Publisher: Oktsec
Language: en
Published: 2026-11-13T02:18:43Z
Updated: 2026-11-13T02:18:43Z
Record reviewed: 2026-11-13T02:18:43Z
Latest evidence check: 2026-11-13T02:21:36Z
Disclosed: 2026-11-07

CISA lists CVE-2026-123218 as exploited, affecting IBM Aspera Faspex 5.0.0 through 5.0.19. Install 5.0.19 PL1 and verify the exact faspex-core image; the base version alone does not establish that the correction is installed.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: CISA lists this exact CVE in KEV from November 9. IBM confirms PL1 and the corrected container image; its authentication prose and CVSS vector remain inconsistent, so the prerequisite is left unresolved.
- Evidence: Attacks confirmed
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Not established
- Vendor: IBM
- Products: Aspera Faspex
- CVEs: CVE-2026-123218

## Technical overview

IBM’s November 7 bulletin describes an authorization bypass that can grant full administrative privileges. The affected range and correction are explicit: Faspex 5.0.0 through 5.0.19, corrected by 5.0.19 PL1 on Linux.

The authentication prerequisite is inconsistent within IBM’s own evidence. Its description refers to an authenticated or authorized user, while the CVSS vector indicates no privileges required. Radar therefore leaves that prerequisite unresolved and does not label the flaw as unauthenticated remote code execution. CISA added this exact CVE to KEV on November 9, establishing exploitation in real attacks. KEV does not identify every affected deployment or prove compromise of all exposed instances.

IBM specifies the exact faspex-core image to verify after patching. Checking only the base version can miss an installation without the fix pack. Oktsec also recommends reviewing unexplained administrative changes; this is a precaution, not a claim that every affected deployment has been compromised.

## Recommended response

Apply Faspex 5.0.19 PL1 and verify faspex-core is 5.0.19 (1ce4b13, Fix Pack: 1). IBM lists no workaround; review unexpected changes to administrator privileges.

Relevant to: Teams operating IBM Aspera Faspex 5 on Linux.

## CVE attribution

- CVE-2026-123218: IBM — Aspera Faspex. [Source](https://www.ibm.com/support/pages/node/7295921)

## Affected systems and fixes

### Aspera Faspex on Linux

Affected: 5.0.0 through 5.0.19 without PL1

Fixed release / action: 5.0.19 PL1; faspex-core 5.0.19 (1ce4b13, Fix Pack: 1)

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.10
Checked: 2026-11-13T02:21:36.147Z

### [CVE-2026-123218](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123218)

- Added: 2026-11-09
- Ransomware use: Not confirmed by CISA
- Federal due date: 2026-11-12
- Federal forensic triage: Yes

Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-123218](https://api.first.org/data/v1/epss?cve=CVE-2026-123218): 0.54% probability of observed exploitation in the next 30 days; percentile 45.63%; score date 2026-11-12.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z.

## Response checklist

1. **Identify Faspex deployments and their container image** — Inventory Faspex 5.0.0 through 5.0.19 on Linux. A displayed version of 5.0.19 does not establish that PL1 is installed.
2. **Apply PL1 and verify the running image** — Follow IBM’s container patch instructions. Validate faspex-core 5.0.19 (1ce4b13, Fix Pack: 1) after the update; IBM lists no workaround.
3. **Review unexpected administrative changes** — Preserve audit logs and investigate unexpected role changes or administrator activity, given CISA’s confirmed exploitation record. Oktsec recommends checking earlier activity as well as applying PL1; updating does not remove an existing compromise.

## Relevance to AI environments

Oktsec recommends including this component in infrastructure inventories used by security automation; this vulnerability is not specific to AI.

## Sources

- [Faspex authorization bypass: affected versions and exact fixed image](https://www.ibm.com/support/pages/node/7295921) — IBM; Vendor notice; checked 2026-11-13T02:13:52Z
- [IBM CNA record for CVE-2026-123218](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123218.json) — IBM (CNA record); Vendor notice; checked 2026-11-13T02:13:41Z
- [CISA KEV: CVE-2026-123218 exploitation confirmation](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-13T02:21:36Z

## Editorial record

- 2026-11-13T02:18:43Z: Added IBM’s exact PL1 correction and CISA’s November 9 exploitation confirmation; retained the unresolved authentication discrepancy.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/ibm-aspera-faspex-cve-2026-123218) · [Build a response plan](https://www.oktsec.com/radar/ibm-aspera-faspex-cve-2026-123218#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=ibm-aspera-faspex-cve-2026-123218&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=ibm-aspera-faspex-cve-2026-123218&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.