The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a critical flaw in IBM Aspera Faspex, and has given American federal agencies until Thursday, 12 November 2026 to fix it. The flaw, tracked as CVE-2026-123218, was added to CISA's Known Exploited Vulnerabilities (KEV) catalogue on 9 November, a list reserved for flaws with evidence of attacks in the wild.

The vulnerability is an incorrect authorisation flaw in Faspex, IBM's high-speed file-transfer product used by organisations to exchange large volumes of data. IBM rates it 9.8 out of 10 under the CVSS scoring system, close to the maximum severity. According to IBM's security bulletin, an authenticated user can craft a specific message to bypass authorisation checks and escalate their privileges, potentially gaining full administrative control of a Faspex deployment. Every Faspex 5 release from version 5.0.0 through 5.0.19 is affected.

How to fix it

IBM published its security bulletin on 7 November 2026 and fixed the flaw in Faspex 5.0.19 PL1. Administrators should upgrade to that release and confirm that the faspex-core container image reads 5.0.19 with Fix Pack 1. IBM lists no workaround, so the security update is the only remediation. CISA also requires covered federal agencies to complete forensic triage, checking logs for signs that attackers created accounts or credentials that would survive patching. Administrators should review administrative accounts, privilege changes and unusual file-transfer activity, and revoke anything they cannot explain.

What is still unknown

CISA has not identified who is exploiting the flaw or how many organisations have been hit, and whether it is being used in ransomware campaigns is listed as unknown. The Aspera flaw was one of four vulnerabilities added to the KEV catalogue on 9 November, alongside flaws in GPUStack, FreeSWITCH and OpenSSH, all with the same 12 November deadline. Private organisations are not bound by CISA's federal deadline, but because exploitation is confirmed, they should treat the date as their own.