CVE-2026-123218

Summary

IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain an authorization bypass vulnerability (CWE-863) allowing an authorized user to escalate privileges to full administrative access by crafting a specific message. This violates the principle of least privilege and enables complete system compromise.

Exploitability

Exploitation requires valid authentication as a non-administrative user and knowledge of how to construct the specific malformed message; no public exploit exists, but the low attack complexity (AC:L) suggests it is feasible for skilled attackers.

Blast radius

Successful exploitation grants full administrative control over Faspex, enabling data exfiltration, system modification, lateral movement, and potential compromise of integrated systems relying on Faspex for file transfer.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Aspera Faspex 5.0.20 or later, which contains the fix for this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.