Article
Remote support and file transfer flaws in ransomware attacks
SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
Read more
Vulnerability
IBM Aspera Faspex Authorization Bypass (CVE-2026-123218)
A missing-authorization flaw in IBM Aspera Faspex, a managed file-transfer product.
- CVE ID
- CVE-2026-123218
- CVSS
- 9.8 Critical (CVSS 3.1, IBM as CNA and NVD primary source); vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no CVSS 4.0 score in the record or NVD
- Affected product
- IBM Aspera Faspex, 5.0.0 through 5.0.19
- Exploited
- Unknown
- Published
- 7 November 2026 (CVE record and NVD); IBM Security Bulletin lists an initial publish date of 7 November 2026 and a modified date of 6 November 2026
In short
CVE-2026-123218 is a missing-authorization flaw in IBM Aspera Faspex, a managed file-transfer product. IBM's own record says an authorized user can craft a specific message that bypasses the authorization check and gains full administrative privileges. IBM, the CNA, scores it CVSS 3.1 9.8 Critical; there is no CVSS 4.0 score in the record or NVD. The fix ships in Faspex 5.0.19 PL1.
- CVECVE-2026-123218
- ProductIBM IBM Aspera Faspex, 5.0.0 through 5.0.19
- Fix Steps5actions listedUpgrade to 5.0.19 PL1
What it allows
IBM Aspera Faspex handles managed file transfers for organizations that move large files between parties. The CVE record, assigned by IBM as the CNA, says an authorized user can craft a specific message that bypasses the product's authorization check, then gain full administrative privileges.
IBM classifies the flaw as CWE-863, Incorrect Authorization. IBM gives no further technical detail beyond that one-line description, the CWE class and the severity rating; the record does not name the affected component or message type.
How CVE-2026-123218 Scores
IBM, the CNA, scores it CVSS 3.1 9.8 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no CVSS 4.0 score in the record or NVD.
A Gap Between the Description and the Vector
The CVE record's prose calls the actor "an authorized user." Its own CVSS vector lists Privileges Required as None, the setting IBM uses when no privileges are needed at all. The record does not explain the difference, so we read the vector as IBM's own assessment of what access the attack needs.
What IBM Says About a Workaround
IBM's bulletin lists "Workarounds and Mitigations: None." The only remediation IBM names is the version upgrade described below.
What IBM and CISA KEV Say About Exploitation
IBM's bulletin and the CVE record do not state whether CVE-2026-123218 has been exploited. As of CISA catalog version 2026.11.06, it is not in the Known Exploited Vulnerabilities catalog.
We note that CISA's KEV catalog separately lists an earlier Aspera Faspex flaw, CVE-2022-47986, with confirmed ransomware-campaign use. That is a different vulnerability in the same product line, not evidence about CVE-2026-123218 itself.
Who is affected
The CVE record lists IBM Aspera Faspex 5.0.0 through 5.0.19 as affected, with a default status of unaffected outside that range. IBM's bulletin states the same range and names 5.0.19 PL1 as the fixed release.
IBM's remediation steps ask operators to upgrade to 5.0.19 PL1 on Linux and to validate that the faspex-core container image matches build 1ce4b13, Fix Pack 1. IBM lists no workaround for operators who cannot upgrade immediately.
IBM credits no external researcher in the bulletin. Its change history lists one entry: initial publication on 7 November 2026. IBM published this fix the same week as another critical missing-authorization flaw, CVE-2026-17362 in IBM API Connect, which lets a remote attacker create, modify or delete tenants.
Timeline
- 5 Nov 2026
CVE-2026-123218 is reserved, per the CVE record.
- 6 Nov 2026
IBM's bulletin lists a modified date of 6 November 2026, a day before its own initial publish date.
- 7 Nov 2026
IBM publishes the Security Bulletin and the CVE record; NVD publishes its entry the same day, status Awaiting Analysis.
What to do
-
Inventory Every Aspera Faspex Instance
List every IBM Aspera Faspex deployment and record its exact version. The CVE record covers 5.0.0 through 5.0.19; any instance in that range needs the fix.
-
Upgrade to 5.0.19 PL1
Move each instance to Faspex 5.0.19 PL1 on Linux, as IBM's bulletin instructs. Confirm the faspex-core container image matches build 1ce4b13, Fix Pack 1, before you call the upgrade complete.
-
Treat the Fix as the Only Mitigation
IBM lists no workaround or interim setting for this flaw. Until an instance is upgraded, we recommend limiting who can reach its message-handling interface.
-
Audit Admin Accounts and Recent Privilege Changes
We recommend reviewing Faspex admin accounts created or elevated since the flaw was reserved on 5 November 2026. IBM's record does not describe detection steps, so this check is ours.
-
Restrict Exposure of File-Transfer Admin Interfaces
Managed file-transfer products are recurring targets; our Cleo file transfer attacks page covers an earlier case. We recommend keeping Faspex admin interfaces off the open internet regardless of patch status.
Questions
Which versions of IBM Aspera Faspex does CVE-2026-123218 affect?
The CVE record and IBM's bulletin both list versions 5.0.0 through 5.0.19. IBM names 5.0.19 PL1 as the fixed release.
Does an attacker need valid credentials to exploit CVE-2026-123218?
The CVE record's description calls the actor "an authorized user," but its own CVSS vector lists Privileges Required as None. IBM's record does not explain the difference between the two.
Is there a workaround before upgrading?
IBM's bulletin lists "Workarounds and Mitigations: None," and names the version upgrade as the only fix.
Is CVE-2026-123218 in the CISA KEV catalog?
It is not in catalog version 2026.11.06. IBM's bulletin and the CVE record do not state whether the flaw has been exploited.
Has IBM Aspera Faspex been targeted by ransomware before?
A separate, earlier Aspera Faspex flaw, CVE-2022-47986, is listed in CISA's KEV catalog with confirmed ransomware-campaign use. That listing concerns a different vulnerability, not CVE-2026-123218.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.