CISA adds IBM Aspera Faspex authorization flaw to KEV

IBM Aspera Faspex contains an incorrect authorization vulnerability allowing authenticated users to bypass authorization checks and escalate privileges. Federal agencies must apply vendor mitigations by November 12, 2026, or discontinue use. CISA's BOD 26-04 prioritization guidance applies. Known ransomware exploitation is not reported.