The Cybersecurity and Infrastructure Security Agency (CISA) added one actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on November 9, 2026. The flaw, CVE-2026-123218, affects IBM Aspera Faspex. It lets a logged-in user escalate privileges. US federal agencies must address it by November 12, 2026, which gives them three days.
| CVE | Vendor and product | Weakness | Added | US federal deadline | Known ransomware use |
|---|---|---|---|---|---|
| CVE-2026-123218 | IBM Aspera Faspex | Incorrect Authorization | 2026-11-09 | 2026-11-12 | Unknown |
IBM Aspera Faspex: Authorization Bypass Leads to Privilege Escalation
The weakness is in how Aspera Faspex decides what a user is allowed to do. A person who already has a valid account can send a carefully constructed message that gets past the product’s permission checks. The result is higher privileges than that account should have.
The attacker needs to be authenticated first, so this is not a flaw that lets a stranger walk in with no credentials. That condition is weaker than it sounds. Stolen passwords, shared accounts, low-privilege guest or partner logins, and former staff accounts that were never disabled all give an attacker the foothold this bug needs. From there, a routine account can become a powerful one.
CISA lists ransomware use for this flaw as “Unknown.” That means the agency has not confirmed a link to ransomware campaigns. It does not mean such use has been ruled out. Inclusion in the catalog means CISA has evidence that the flaw is being exploited in real attacks.
Who should care: any organization that runs IBM Aspera Faspex, especially where outside partners, customers or contractors have accounts on the system.
What to do: Apply IBM’s update or mitigation for this vulnerability. CISA’s required action tells agencies to follow the vendor’s instructions. Agencies must also comply with Binding Operational Directive (BOD) 26-04, “Prioritizing Security Updates Based on Risk,” and with CISA’s “Forensics Triage Requirements.” For cloud services, CISA points to the BOD 26-04 guidance. If no mitigation is available, CISA directs agencies to stop using the product.
Why the Federal Deadline Matters to Everyone Else
The remediation dates in the catalog are binding only on US federal civilian agencies. Businesses, schools and local governments are not required to meet them. They are still a useful benchmark, because CISA sets them for flaws that attackers are already using.
The window here is short. The entry was added on November 9 and is due on November 12. Treat this one as an immediate task, not something for the next scheduled maintenance cycle.
The “Forensics Triage Requirements” reference in the required action is also worth noting. Because the flaw is being exploited, patching alone may not be enough. Systems that were exposed before the fix should be checked for signs that someone already used the bug.
What to Do This Week
- Find every IBM Aspera Faspex instance you run, including test, staging and partner-facing servers.
- Apply IBM’s update or mitigation for CVE-2026-123218. Aim to finish by November 12, 2026, in line with the federal deadline.
- If you cannot apply a fix, restrict access to the system or take it offline until you can.
- Review user accounts. Disable unused ones, reset shared credentials, and look for any account whose privileges changed unexpectedly.
- Check logs on exposed systems for unusual activity by authenticated users, following CISA’s forensics triage guidance where it applies.
FAQ
– Can an attacker exploit this without a password?
No. The attacker needs an authenticated account first. A stolen or low-level login is enough to start, and the flaw can then be used to gain higher privileges.
– Is this flaw linked to ransomware?
CISA lists known ransomware campaign use as “Unknown.” The agency has not confirmed a ransomware connection, but the flaw is being exploited in attacks.
– What if IBM’s fix cannot be applied right away?
CISA’s guidance for federal agencies is to stop using the product if mitigations are unavailable. Other organizations should at least limit who can reach the system until a fix is in place.