IBM Aspera Faspex 5 user-to-admin bug hits CISA KEV: your file portal has a promotion problem
somewhere a regular Faspex user sent “a specific message” and the server answered by handing them the admin keys. IBM fixed it on November 7, CISA put CVE-2026-123218 on the Known Exploited Vulnerabilities list on November 9, and the federal due date is November 12. that is three days. the sloth has naps longer than that.
the exact condition, no inflation
- the attacker starts as a logged-in Faspex user. IBM’s description says “an authorized user,” and CISA’s KEV entry says “an authenticated user.” the end state is full administrative privileges on Faspex. this is privilege escalation inside the application, not a credential-free takeover, according to both text descriptions.
- the score disagrees with the words. IBM’s own CVSS vector says
PR:N(no privileges required), which does not match “authorized user.” we report both as published and do not pick a side. practical read: if your Faspex hands out accounts to outside partners, clients or anyone who can self-register, “authenticated” is a low bar. - what the message is: not public. IBM does not describe it, and there is no named victim or published indicator list as of writing. no acknowledgement is listed in the bulletin.
scores, and who gave them
- IBM (vendor and CNA): CVSS 3.1 9.8 Critical,
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. the bulletin lists “CVSS Source: IBM.” - NVD: status “Undergoing Analysis.” NVD shows IBM’s 9.8 as the only score and had not published its own at the time of writing.
- CISA ADP (Vulnrichment) in the CVE record: no CVSS score, SSVC exploitation “active”, automatable “yes”, technical impact “total”.
affected and fixed (from IBM bulletin 7295921)
- affected: IBM Aspera Faspex 5.0.0 through 5.0.19. yes, plain 5.0.19 is in the affected range.
- fixed: 5.0.19 PL1 (Linux). IBM says to validate that the
faspex-corecontainer image is 5.0.19 (1ce4b13, Fix Pack: 1), and points to its “patching container images” docs. - workarounds and mitigations: IBM lists none. patching is the fix.
- Faspex 4.x: not listed. IBM’s disclaimer says its bulletins only cover supported versions and that not listing a version is not a statement that it is unaffected. if you still run Faspex 4, that is its own conversation.
what to do today
- inventory. every Faspex 5 instance, including the “temporary” one marketing set up for a vendor in 2024.
- patch to 5.0.19 PL1 and confirm
faspex-corereports 5.0.19 (1ce4b13, Fix Pack: 1). do not trust the change ticket, trust the running image. - until it moves, shrink who can reach it. restrict the web interface to known partner networks or a VPN where you can, and remove stale, shared and unneeded accounts. this is hygiene, not an IBM-listed workaround, so do not treat it as a fix.
- audit admins. list every account with admin rights, compare it against who is supposed to have them, and look hard at admin grants and account changes since before the patch. CISA flagged forensic triage for this entry, so preserve logs before you clean up.
download the Kali defensive checks
aspera-faspex-123218-defensive-check.zip contains three defensive scripts with the fixed version baked in (5.0.19 PL1, faspex-core 5.0.19 build 1ce4b13, Fix Pack 1). faspex-123218-version-check.py reads an inventory CSV you export and flags anything in 5.0.0 through 5.0.19 without Fix Pack 1. faspex-admin-audit.py compares a user export against your approved-admin list and flags recent admin or account changes. faspex-exposure-check.sh lists Faspex containers and listening web ports on a host you own and only prints a suggested firewall allowlist. none of them exploit anything, and none of them prove or disprove compromise on their own. export column names vary, so map them first.
sloth take
a managed file transfer portal is a box whose entire job is letting outsiders log in and hand you files. so “any logged-in user can become admin” is not a small bug, it is the business model with the safety off. patch to 5.0.19 PL1, check the running image, then go count your admins. if the number surprises you, that is not a counting error. the sloth counted twice. slowly.
sources
- IBM, Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass (initial publication November 7, 2026)
- CVE record CVE-2026-123218 (IBM CNA), with CISA ADP SSVC and KEV entry
- CISA KEV entry (added November 9, 2026, due November 12, 2026)
- NVD CVE-2026-123218
- CISA KEV entry for CVE-2026-123158 (added November 9, 2026, due November 12, 2026)
