Taiwan Information Security Association
Join TWISA
Menu

Exploitation reportedTue, 10 Nov 2026

IBM Aspera Faspex exploitation: update and investigate file-transfer systems

CISA reports active exploitation of an authorization bypass in IBM Aspera Faspex 5. Inventory transfer services, apply IBM’s fix and investigate administrative access and file activity.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

CVE-2026-123218 affects IBM Aspera Faspex 5.0.0 through 5.0.19 and was added to CISA’s Known Exploited Vulnerabilities catalog on 2026/11/09. IBM rates it CVSS v3.1 9.8. IBM describes an authorized user crafting a specific message to bypass authorization and obtain full administrator privileges, while its published CVSS vector assigns PR:N. Assess exposure without assuming an unauthenticated attack path. An affected transfer service may hold sensitive files and have access to other systems.

Attack flowFrom service access to potential data impact
  1. 01

    Transfer service reachable

    An affected Faspex deployment is accessible

  2. 02

    Authorization bypass

    IBM describes an authorized user sending a specific message

  3. 03

    Administrator access

    Authorization may be bypassed to gain full administrative privileges

  4. 04

    Further impact

    Files, accounts and connected systems may be affected according to actual permissions

Affected and fixed versions

  • IBM lists Faspex 5.0.0 through 5.0.19 as affected. For Linux, update to 5.0.19 PL1 and verify that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1).
  • Inventory internet-facing, internal, outsourced, test, backup and containerized deployments. Ask service providers to confirm their deployed version and maintenance schedule. IBM lists no workaround or mitigation for this vulnerability.
Response flowRecommended actions: from the perimeter to core systems
  1. 01

    Inventory and restrict access

    Map transfer services and management interfaces, including outsourced and container deployments. Restrict unnecessary access and review accounts and authentication.

    See what to doResources: 4

    TWISA member solutions

    Inventory and restrict access

    Applicable offer: 眾至資訊’s 新世代防火牆NU-6000 can be deployed on the relevant network path to restrict sources and segment networks. Configure and verify it for the environment, and still update the affected product. The TWISA offer runs through 2026/12/31: code TWISA2026_ShareTech, 5% discount, one year of AI IPS and AI Sandstorm protection, and a 30-month hardware warranty.

  2. 02

    Update and verify

    Follow IBM’s instructions to update to 5.0.19 PL1. Verify the running faspex-core image and test legitimate transfers and integrations.

    See what to doResources: 1

    TWISA member solutions

    Update and verify

    Follow IBM’s instructions to update to 5.0.19 PL1. Verify the running faspex-core image and test legitimate transfers and integrations.

  3. 03

    Preserve and investigate

    Preserve management, authentication and transfer logs. Review administrative access, new accounts, privilege changes and unusual transfers; coordinate log retention with providers.

    See what to doResources: 2

    TWISA member solutions

    Preserve and investigate

    Preserve management, authentication and transfer logs. Review administrative access, new accounts, privilege changes and unusual transfers; coordinate log retention with providers.

  4. 04

    Contain data impact and recover

    If compromise is suspected, isolate affected systems, preserve evidence, revoke sessions and rotate exposed service credentials. Assess accessible files and connected systems, restore from trusted backups and retest.

    See what to doResources: 3

    TWISA member solutions

    Contain data impact and recover

    If compromise is suspected, isolate affected systems, preserve evidence, revoke sessions and rotate exposed service credentials. Assess accessible files and connected systems, restore from trusted backups and retest.

Defense architectureTransfer entry, execution environment and data

Inventory transfer services, management paths, versions, containers, accounts and integrations

Allow authorized traffic and apply controls at each layer.

  1. 01

    Transfer entry

    External and partner connections

    Restrict accessLimit sources and review authentication

  2. 02

    Faspex service

    Transfer server and containers

    Apply the fixUpdate 5.0.19 PL1 and verify the running image

  3. 03

    Data and integrations

    Files, service accounts and connected systems

    Limit privilegesRestrict file access, credentials and network paths

Feed logs and traffic data from each layer into monitoring and response.

  1. Monitor, investigate and recoverCorrelate identity, management and transfer logs; preserve evidence and validate recovery.

Proactive testing and retesting

With authorization, perform asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Include outsourced and container deployments and retest after changes. If a WAF is used, verify request paths, alerts, actual blocking and backend results separately; do not treat website request checks as a substitute for host or internal-network investigation.

TWISA member solutions

Official sources

For further product and service details, please contact the relevant TWISA members.

Advisory updated: 2026/11/11. Consult the vendor’s latest information for product support and patch status.