Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User
IBM Aspera Faspex CVE-2026-123218 allows authenticated users to bypass authorization and gain admin access.
IBM released a security update for CVE-2026-123218, a critical vulnerability in Aspera Faspex versions 5.0.0 through 5.0.19 (CVSS 9.8) that allows authenticated users to bypass access checks and gain full administrative privileges via specially crafted messages. The flaw falls under CWE-863 (incorrect authorization) and is listed on CISA's catalog as exploited. IBM recommends upgrading to Faspex 5.0.19 PL1 and verifying the fix-pack details (build identifier "1ce4b13" and "Fix Pack: 1") to ensure proper patching.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IBM?
Get an email when a new story names IBM, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical flaw (CVE-2026-123218, CVSS 9.8) in IBM Aspera Faspex allowed any authenticated user to escalate privileges to full administrator level by sending specially crafted messages, exploiting an incorrect authorization check (CWE-863). This means that even low-privileged, legitimate accounts could be weaponized to take over the platform entirely, bypassing all role-based access controls. The vulnerability was actively exploited in the wild before many organizations applied the fix, highlighting the danger of delayed patching for internet-facing file transfer systems. Because file transfer platforms like Aspera often handle sensitive or large-volume data, administrative compromise can have severe downstream consequences for data integrity and confidentiality.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-123218