L3 · ShartedIBM · Aspera · authorizationibm-aspera-faspex-authz

IBM Aspera Faspex authorization bypass can grant full administrator access

IBM says a crafted message can grant full administrative privileges on Faspex 5.0.0 through 5.0.19. Its text describes an authenticated user, while its CVSS vector lists no privileges required. The Linux fix is 5.0.19 PL1. Check the running faspex-core image for build 1ce4b13 and Fix Pack 1.

Disclosed: Nov 7, 2026; Public disclosure date
Severity: CVSS 9.8; 1 CVE tracked here
Splash zone: IBM Aspera Faspex 5.0.0 through unpatched 5.0.19. IBM's narrative and scoring disagree on the login requirement.; IBM · Aspera · authorization
In the wild: Unknown; The IBM sources establish the vulnerability and fix, without reporting exploitation.

What happened

IBM’s bulletin summary describes an authenticated user, and the vulnerability text refers to an authorized user. The same bulletin and CNA record use PR:N in the CVSS vector. The reviewed sources do not resolve whether credentials are required. Restrict access and patch even when Faspex already requires login. The advisory identifies no workaround and reports no observed attacks or affected customers.

What’s in the bowl

CVE-2026-123218CVSS 9.8

Authorization bypass to full administrator

IBM says a crafted message can grant full administrative privileges. The score is IBM's CVSS 3.1 assessment.

Fixed versions

Product	Safe from	Note
IBM Aspera Faspex on Linux	`5.0.19 PL1`	Verify faspex-core 5.0.19 build 1ce4b13, Fix Pack 1

Crime-scene timeline

Nov 7, 2026
IBM publishes the Faspex security bulletin and CVE
IBM identifies the vulnerable range and recommends applying the Linux patch level.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

IBM Faspex security bulletinPrimaryLists affected releases, conflicting prerequisite signals and the exact Linux fix and image build.
IBM CNA recordPrimaryRecords IBM's description, CVSS vector and patch verification details.

Wipe guide

The wipe checklist

0 of 3 sheets used

Inventory Faspex and limit who can reach itCheck deployed Faspex versions and review firewall or reverse-proxy rules. Restrict access from untrusted networks while preparing the patch. Do not rely on the login screen alone while IBM's prerequisite is unclear.
Install the vendor patch level and verify the running imageFollow IBM's linked Faspex container-image patch instructions for 5.0.19 PL1. Check that the running faspex-core image reports 5.0.19 build 1ce4b13 and Fix Pack 1, then test authorized transfers and administration.
Review administrator changes and preserve evidencePreserve Faspex and proxy access logs. Review new administrator grants and unexpected administrative activity against approved changes. If suspicious activity is found, investigate access and scope affected credentials before rotating them from a clean system.