CISA adds an exploited IBM Aspera Faspex bug due November 12

CISA added an IBM Aspera Faspex bug to its known-exploited catalog on November 9. The entry is CVE-2026-123218. The due date is November 12. CISA says a logged-in user could send a crafted message that skips an authorization check and raises that user's privileges. It marks ransomware use as unknown, and it says forensic triage is required under BOD 26-04. NVD has not posted a score for this bug.

NVD's description covers Faspex versions 5.0.0 through 5.0.19. It says an authorized user could gain full administrative privileges. That is stronger than the catalog's privilege-escalation wording, and the two pages do not use the same login term. IBM's vector string on the NVD page lists no privileges required. CISA's entry says the user is authenticated. The article does not treat the vector as a score. NVD says its own assessment is not yet provided.

CISA tells agencies to apply the vendor fix, or to stop using the product if no fix is available. The catalog action also points agencies to BOD 26-04 and to a forensics-triage note. It does not name a patch version. It does not say how many systems are exposed.

This is a separate addition from the three bugs CISA listed earlier on November 9. Those were an OpenSSH authentication bypass, a FreeSWITCH injection bug, and a GPUStack authentication bypass, all with the same November 12 due date. The Faspex entry is the new line on the catalog's first page. CISA does not say the four bugs are related.