Aspera Faspex privilege escalation, exploited (CVE-2026-123218)

Actively exploited in the wild - CVE-2026-123218 is a critical authorization bypass in IBM Aspera Faspex 5.0.0 through 5.0.19 that lets a low-privileged authorized user craft a specially formed message and gain full administrative privileges on the server.

Overview

IBM Aspera Faspex is an enterprise file-exchange platform used to move large files between organizations. In versions 5.0.0 through 5.0.19, an attacker who already holds a valid but unprivileged account can send a crafted message to the application and bypass the authorization checks that separate ordinary users from administrators.

The vulnerability carries a CVSS score of 9.8 (Critical). The vector shows network reachability, low attack complexity, no privileges required, and no user interaction, which is why the score sits at the top of the scale. In practical terms, an outsider who can reach the login page and obtain any valid account, even a minimal one, has a realistic path to domain-wide control of the Faspex instance.

Impact

Successful exploitation elevates an ordinary user to full administrator. From there an attacker can read or exfiltrate every package, file transfer, and user record held on the platform, create or modify accounts, alter transfer policies, and use the server as a foothold for further lateral movement into the corporate network. Because Faspex routinely handles confidential document and media exchanges between partners, the data-loss implications extend well beyond the host itself.

CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities catalog, confirming that attackers are already using it against real installations. The EPSS score of roughly 0.4 percent for the next 30 days is low, so opportunistic mass scanning is unlikely; the active exploitation signal points instead to targeted campaigns against known Faspex deployments. Organizations that expose the platform to the internet should treat this as a priority.

Remediation and Mitigation

• Update IBM Aspera Faspex to a release later than 5.0.19. IBM publishes the fixed version and full details in its official security bulletin for this CVE; confirm the exact target build with the vendor before upgrading.
• If you cannot patch immediately, restrict network access to the Faspex web interface to trusted addresses, place it behind a VPN or reverse proxy with strong authentication, and enforce multi-factor authentication for all accounts.
• Review logs for unexpected account creations, privilege changes, or anomalous package activity, and treat any suspicious administrator session as a potential compromise.
• Rotate credentials and API tokens on the appliance after upgrading if you have any reason to suspect prior exploitation.

Security Insight

This case fits a pattern that has dogged Aspera Faspex for years: access-control logic that trusts the shape of a message rather than the identity of the sender. A similar authorization bypass in Faspex 4.x (CVE-2022-47986) was also exploited in the wild after disclosure, which suggests the underlying permission model has never been hardened in depth. For defenders, the takeaway is that file-transfer appliances sitting on the internet perimeter keep recurring as high-value targets, and “authenticated user” should never be treated as a safe boundary.

For breach tracking and ongoing coverage, see our breach reports and security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs