Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User

IBM has released a security update for a critical IBM Aspera Faspex vulnerability that lets a signed-in user bypass access checks and gain full administrative privileges.

Tracked as CVE-2026-123218, the flaw affects versions 5.0.0 through 5.0.19 and carries a CVSS severity score of 9.8. IBM published its security bulletin on November 7, 2026.

The supplied CISA catalog entry lists the vulnerability as exploited, with an addition date of November 9 and a remediation deadline of November 12, 2026. It also marks forensic triage as required and ransomware use as unknown.

However, we could not independently retrieve the specific entry during verification. IBM’s bulletin does not describe attack campaigns, victims, or exploitation methods beyond a specially crafted message.

According to IBM’s security bulletin, an authenticated user can craft a specific message that bypasses user authorization. Successful exploitation gives that user full administrative privileges within Faspex.

The advisory does not identify the affected endpoint, message fields, or exact request needed to trigger the flaw. The weakness falls under CWE-863, or incorrect authorization. In simple terms, the software fails to check whether a user has permission to act.

Logging in proves who someone is, but authorization should still prevent a standard account from performing tasks reserved for administrators.

Hackers Exploit IBM Aspera Faspex Vulnerability

IBM’s published details show an important mismatch. Its description says the attacker must already be an authorized user. At the same time, its CVSS vector includes “PR: N,” which means no prior privileges are required.

Until IBM clarifies this difference, the stated signed-in requirement should guide descriptions of the attack rather than claims that anyone can exploit it without an account.

The published score rates potential effects on data privacy, data integrity, and service availability as high. However, the bulletin does not establish that attackers can execute operating system commands or obtain root access. Full Faspex administration and control of the underlying Linux host are different outcomes.

Cyber Security News previously covered a separate IBM Aspera Shares vulnerability involving sessions that remained valid after password changes. That issue affected another Aspera product and should not be confused with this Faspex authorization bypass.

IBM strongly recommends upgrading affected Linux deployments to Aspera Faspex 5.0.19 PL1. Administrators must then verify that the faspex-core container image reports version 5.0.19 with build identifier “1ce4b13” and “Fix Pack: 1.” Checking only the main version number could miss whether the required fix is installed.

IBM lists no workarounds or alternative mitigations. Teams should follow the patch instructions linked in the bulletin and confirm the running container contains the corrected image. A deployment still showing version 5.0.19 without the required fix-pack details should not be treated as patched.

For defenders following vulnerability news, this case highlights why patch verification matters. Confirming the exact fixed build is essential when vulnerable and corrected releases share the same main version number.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User appeared first on Cyber Security News.