CISA adds IBM Aspera Faspex authorization bypass to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited incorrect authorization vulnerability in IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog.
Why it matters.IBM Aspera Faspex transfers large data packages and media archives across corporate hybrid cloud topologies. When authenticated users elevate privileges to platform administrators, attackers exfiltrate proprietary enterprise datasets and manipulate package delivery workflows. Infrastructure engineering leads should upgrade Aspera Faspex servers to version 5.0.20 or later. Security teams should audit user role assignments across transfer clusters.