CISA Adds IBM Aspera Faspex Vulnerability to KEV List Amid Exploitation Concerns

## Overview CISA added CVE-2026-123218 to its Known Exploited Vulnerabilities (KEV) list on November 9, 2026. This vulnerability affects IBM Aspera Faspex versions 5.0.0 through 5.0.19. It allows an authenticated user to bypass authorization and gain full administrative privileges. The addition to the KEV list indicates a federal deadline for remediation by November 12, 2026. ## Technical Details The vulnerability is categorized as an incorrect authorization issue. An attacker with valid credentials can craft a specific message that exploits this flaw. This action leads to privilege escalation, enabling unauthorized access to administrative functions within the Aspera Faspex application. The high CVSS score of 9.8 highlights the severity of this vulnerability. ## Impact Organizations using affected versions of IBM Aspera Faspex are at risk of unauthorized access and potential data breaches. An attacker gaining administrative privileges could compromise sensitive data and disrupt operations. The exploitation of this vulnerability poses significant risks to data integrity and confidentiality. ## Mitigation IBM has not yet released a public patch for this vulnerability. Organizations should monitor for updates from IBM and apply any available patches as soon as they are released. In the interim, limiting user privileges and implementing strict access controls can help mitigate the risk. Regularly reviewing user permissions and monitoring for unusual activity is also advisable.