[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2FoBZgEjAqp4-9X5RMTs10CIxSDsCpEkg3friEJHkOQ":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"5ea79022-0d91-4a5a-ab18-d5673aecbc9e","Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User","hackers-exploit-ibm-aspera-faspex-vulnerability-granting-admin-access-to-any-use-413570","IBM has released a security update for a critical IBM Aspera Faspex vulnerability that lets a signed-in user bypass access checks and gain full administrative privileges. Tracked as CVE-2026-123218, the flaw affects versions 5.0.0 through 5.0.19 and carries a CVSS severity score of 9.8. IBM published its security bulletin on November 7, 2026. The supplied […] The post Hackers Exploit IBM Aspera Faspex Vulnerability, Granting Admin Access to Any User appeared first on Cyber Security News.","IBM released a security update for CVE-2026-123218, a critical vulnerability in Aspera Faspex versions 5.0.0 through 5.0.19 (CVSS 9.8) that allows authenticated users to bypass access checks and gain full administrative privileges via specially crafted messages. The flaw falls under CWE-863 (incorrect authorization) and is listed on CISA's catalog as exploited. IBM recommends upgrading to Faspex 5.0.19 PL1 and verifying the fix-pack details (build identifier \"1ce4b13\" and \"Fix Pack: 1\") to ensure proper patching.","IBM Aspera Faspex CVE-2026-123218 allows authenticated users to bypass authorization and gain admin access.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploit-ibm-aspera-faspex-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-IBM-Aspera-Faspex-Vulnerability-Granting-Admin-Access-to-Any-User.webp","2026-11-10T13:49:07+00:00","2026-11-10T14:00:28.466518+00:00",9,[17,20,23],{"name":18,"type":19},"IBM Aspera Faspex","product",{"name":21,"type":22},"IBM","vendor",{"name":24,"type":25},"CWE-863","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-123218","Critical authorization bypass vulnerability in IBM Aspera Faspex versions 5.0.0-5.0.19",[21,18],{"controls":54,"vendors":138},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[60,68,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":56,"product_name":72,"url":73,"description":74},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":84,"name":85,"problem":86,"products":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":134,"product_name":135,"url":136,"description":137},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"ibm-aspera-faspex-authorization-bypass-grants-admin-access-to-any-authenticated-user","IBM Aspera Faspex Authorization Bypass Grants Admin Access to Any Authenticated User","A critical flaw (CVE-2026-123218, CVSS 9.8) in IBM Aspera Faspex allowed any authenticated user to escalate privileges to full administrator level by sending specially crafted messages, exploiting an incorrect authorization check (CWE-863). This means that even low-privileged, legitimate accounts could be weaponized to take over the platform entirely, bypassing all role-based access controls. The vulnerability was actively exploited in the wild before many organizations applied the fix, highlighting the danger of delayed patching for internet-facing file transfer systems. Because file transfer platforms like Aspera often handle sensitive or large-volume data, administrative compromise can have severe downstream consequences for data integrity and confidentiality.",[144,145,146,147,148],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A01:2021 Broken Access Control","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":150,"NIST SP 800-53 AC-6: Least Privilege":151,"OWASP A01:2021 Broken Access Control":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"CIS Control 7: Continuous Vulnerability Management (v8)":154},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling, meaning operators of Aspera Faspex must have processes to promptly apply vendor security updates for critical flaws.","AC-6 requires that users are granted only the minimum privileges necessary, a principle whose enforcement at the authorization layer would have prevented low-privileged users from escalating to administrator.","This vulnerability is a textbook instance of broken access control (CWE-863), where the application failed to correctly enforce authorization checks, allowing privilege escalation via crafted messages.","SI-2 mandates timely identification and remediation of software flaws, directly addressing the need to apply IBM's fix-pack before this vulnerability was exploited in the wild.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which would have driven faster patching of this CVSS 9.8 flaw before active exploitation occurred."]