Low Severity
CVE-2026-123218
Published: Nov 10, 2026
Detection-only triage for IBM Aspera Faspex CVE-2026-123218 (CVSS 9.8, CISA KEV): grades Faspex 5 installs against the 5.0.19 PL1 fix, catches the bare-5.0.19 trap.
# `faspex-scanner`
Local triage for `CVE-2026-123218`, a critical authorization bypass in `IBM Aspera Faspex 5` that hands an authorized user full administrative control. Give it a `Faspex` version you own, or the install root on the host, and it tells you whether that install is still open. It never touches the network, never probes a server, never sends a crafted message.
## `The flaw`
`CVE-2026-123218` is an incorrect authorization flaw (`CWE-863`) in `IBM Aspera Faspex 5`. An authorized user can craft a specific message that bypasses user authorization and gains full administrative privileges. `IBM` rates it `CVSS 3.1 9.8` (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`). The bulletin (`7295921`) was published on `7 November 2026`. Two days later, on `9 November`, `CISA` added the flaw to its `Known Exploited Vulnerabilities` catalog with a federal remediation deadline of `12 November 2026`. That three-day deadline is unusually short, and `CISA` only lists flaws it has evidence are actively exploited. `IBM` lists no workaround, so patching is the only fix.
The fix is `Faspex 5.0.19 PL1` (`Fix Pack 1`). `IBM`'s own check for a patched container deployment is that the `faspex-core` image reads `5.0.19 (1ce4b13, Fix Pack: 1)`. The affected range is every `Faspex 5` release from `5.0.0` through `5.0.19`, which means every `Faspex 5` install that has not taken this fix pack is open.
## `The traps`
| `Signal` | `Grade` | `Why` |
| --- | --- | --- |
| A bare `5.0.19` | `UNKNOWN` | **The PL1 trap.** The fix is `5.0.19 PL1`, not `5.0.19`. A bare `5.0.19` does not prove `Fix Pack 1` is installed, and a `5.0.19` install without the fix pack is still vulnerable. This tool refuses to clear it. Confirm the `faspex-core` image reads `5.0.19 (1ce4b13, Fix Pack: 1)`. |
| `5.0.19 (1ce4b13, Fix Pack: 1)` | `PATCHED` | That is `IBM`'s own validation string for the fixed container image. |
| `5.0.19 PL0` or `Fix Pack: 0` | `VULNERABLE` | `Fix Pack 0` is the base `5.0.19` release. The f