# CVE-2026-123218: IBM Aspera Faspex Incorrect Authorization Vulnerability

- Exploited (CISA KEV): yes, added 2026-11-09
- Published: 2026-11-07
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 0.4% (34th percentile)
- CWE: CWE-863

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

34 posts seen since 2026-11-07.

- mastodon 2026-11-09: ⚠️ Exploited in the wild: CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability Added to CISA KEV · Critical 9.8 Impacted if: IBM Aspera Faspex ≤ 5.0.19 https:// ax-news.com/cve/CVE-2026-123218 # CVE # KEV # infosec (https://infosec.exchange/@axnews/117588559051420769)
- mastodon 2026-11-09: Added to CISA's Known Exploited Vulnerabilities catalog: CVE-2026-123218 IBM Aspera Faspex Incorrect Authorization Vulnerability CVSS 9.8 (Critical). EPSS 0.4%. US federal agencies must remediate by 2026-11-12. IBM Aspera Faspex contains an incorrect authorization vulnerability… (https://infosec.exchange/@overflo_ws/117588325312197499)
- bluesky 2026-11-09: Zero-day · Newly listed by CISA: IBM Aspera Faspex IBM Aspera Faspex Incorrect Authorization Vulnerability  What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using…  https://patchsonar.com/cve/CVE-2026-123218 #ZeroDa… (https://bsky.app/profile/patchsonar.com/post/3mzvvtao3os2f)
- bluesky 2026-11-09: ⚠️ FAILLE CRITIQUE  CVE-2026-123218 activement exploitée : IBM Aspera Faspex – Autorisation incorrecte  🔗 https://infonewscyber.fr/info/cve-2026-123218-activement-exploitee-ibm-aspera-faspex-autorisation-in-2464fd9dd15852ea #IBM #ZeroDay #Cybersécurité (https://bsky.app/profile/infonewscyber.bsky.social/post/3mzvuzve3ii2g)
- x 2026-11-09: 🚨セキュリティ速報 🇺🇸IBM Aspera Faspex 危険度:緊急(悪用あり)  管理者権限を奪える脆弱性(CVE-2026-123218、CVSS9.8)の悪用を確認し米CISAがKEVに追加。回避策はなく、5.0.19 PL1へ早急に更新を。  #サイバーセキュリティ #脆弱性情報 #情報漏洩 #権限昇格 #IBM (https://x.com/sec_alert_chan/status/2119902775123304949)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-123218 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-123218