CISAAnalysisCISA adds IBM Aspera Faspex authorization bypass to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited incorrect authorization vulnerability in IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog.
Why it matters.IBM Aspera Faspex transfers large data packages and media archives across corporate hybrid cloud topologies. When authenticated users elevate privileges to platform administrators, attackers exfiltrate proprietary enterprise datasets and manipulate package delivery workflows. Infrastructure engineering leads should upgrade Aspera Faspex servers to version 5.0.20 or later. Security teams should audit user role assignments across transfer clusters.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-123218 with an 8.8 CVSS score, an incorrect authorization defect allows authenticated users to bypass permission boundaries.
- Exploitation impact: Authenticated attackers send crafted API payloads to escalate privileges to full administrative control across the file exchange platform.
- Affected deployments: The defect impacts IBM Aspera Faspex versions 5.0.0 through 5.0.19 running across enterprise data transfer environments.
- Federal directive: CISA mandated that Federal Civilian Executive Branch agencies remediate the flaw under Binding Operational Directive 26-04.
- Remediation update: IBM released maintenance updates addressing the authorization check, urging administrators to upgrade past version 5.0.19.