CVE-2026-123218
IBM Aspera Faspex Incorrect Authorization Vulnerability
9.8CVSS base score · critical (NVD)
0.7%Chance of exploitation in the next 30 days (FIRST EPSS)
ExploitedIn CISA KEV · federal patch deadline Nov 12, 2026
What is it?
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Official description from NVD.
What happened
CISA added CVE-2026-123218 and CVE-2026-116779 affecting IBM Aspera Faspex and SignalWire FreeSwitch to its Known Exploited Vulnerabilities catalog. Both vulnerabilities are exploited in active attacks. Federal agencies must patch within three days. Prioritize patching if you deploy these products in internet-facing environments.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalCISA adds IBM Aspera Faspex to KEVNov 10, 2026
- HighCISA adds IBM Aspera Faspex authorization flaw to KEVNov 9, 2026