{"affected":[{"defaultStatus":"unaffected","product":"Aspera Faspex","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"5.0.19","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-123218","cwes":["CWE-863"],"description":"IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.","epss":{"date":"2026-11-09","percentile":0.34123,"score":0.00396},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: psirt@us.ibm.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794257904700,"publishedAt":1794023239566,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295921"},{"source":"ADP: CISA-ADP","tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123218"},{"source":"psirt@us.ibm.com","tags":[],"url":"https://www.ibm.com/support/pages/node/7295921"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now by upgrading:\n\nProductVersionPlatformFix InstructionsIBM Aspera Faspex5.0.19 PL1Linux\n\nPlease follow the instructions  here https://www.ibm.com/docs/en/aspera-faspex/5.0.x .\n\n\n\nValidate that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1)"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7295921"}],"revision":"45ee42db1ad15efbdf81b0eeeb76550e9913ebd9d27cdd9a5897c522399f4754","sources":[{"modifiedAt":1794257904700,"name":"CNA: ibm","retrievedAt":1794258566961,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123218"},{"modifiedAt":1794025049027,"name":"NVD","retrievedAt":1794032178340,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123218"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794258583234,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-123218"}],"ssvc":{"assessedAt":1794256842498,"automatable":"yes","exploitation":"active","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"IBM Aspera Faspex Authorization Bypass","updatedAt":1794258583234}