On Monday, November 9, 2026, CISA added a flaw in IBM Aspera Faspex, IBM's server software for sending very large files to clients and partners, to its Known Exploited Vulnerabilities catalog, based on evidence that attackers are using it. The bug, CVE-2026-123218, lets a user with access to the server craft a specific message that bypasses authorization and grants full administrator rights. IBM published a fix on November 7. If your firm moves big design, print, video or engineering files through Faspex, or a partner sends you Faspex links, here's what to check this week.
What IBM and CISA have said
IBM's security bulletin, first published November 7, 2026, says IBM Aspera Faspex 5 "could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges." The affected versions are Faspex 5.0.0 through 5.0.19. IBM rates the flaw 9.8 out of 10 and "strongly recommends addressing the vulnerability now" by upgrading to Faspex 5.0.19 PL1, then confirming the faspex-core container image reports "5.0.19 (1ce4b13, Fix Pack: 1)." Under workarounds and mitigations, IBM lists "None."
Two days later, CISA added four vulnerabilities to the KEV catalog "based on evidence of active exploitation," including this Faspex flaw. (The others were in GPUStack, SignalWire FreeSwitch and OpenSSH.) The catalog entry gives federal civilian agencies until November 12 to fix it, flags it for CISA's forensic triage requirements (checking whether a system was already compromised before it was patched), and lists known ransomware use as "Unknown."
As SecurityWeek noted, "IBM's advisory makes no mention of exploitation, and no details on the attacks appear to be public." One wrinkle: IBM's text says the attacker is an "authorized user," while the severity score IBM published assumes no privileges are required. IBM hasn't explained the difference, so the safe reading is that any account on the server, including an outside partner's or a guest's, could be enough.
This isn't Faspex's first time on the list. CISA added an older Faspex 4 flaw, CVE-2022-47986, in February 2023, and the catalog marks that one as known to have been used in ransomware campaigns. That history belongs to the older bug, not this one.
What we are not claiming: We don't know who is exploiting CVE-2026-123218, how many servers have been hit, or whether any files have been taken, and neither IBM nor CISA has said. We are not saying this is a ransomware campaign; CISA lists ransomware use as unknown. We are not saying any particular company, industry or Brotherly client has been affected, or that every production, engineering or manufacturing firm runs Faspex. The industry examples below describe the kinds of firms that move large files to outside partners, not known victims.
Why this matters for production, engineering and manufacturing firms
Faspex is built for moving big files fast to people outside your network. At the firms we're talking about, those files could be show graphics and print-ready artwork for an exhibit build, video edits, CAD models and drawing sets, shop drawings for a fabricator, or large data packages for a customer. That makes a Faspex server a place where your most valuable project files and your partners' accounts sit together. A full administrator on that server could see what's been sent, change sharing settings, or add accounts. Many smaller firms don't run Faspex themselves but receive it from a client, printer or larger partner, which puts the question on their vendor list instead of their server list.
What to do this week
- Find out whether you have it. Ask your IT provider, or whoever manages your file-transfer tools, whether you run IBM Aspera Faspex, including test, backup or container copies. Note which version.
- If you run Faspex 5, update to 5.0.19 PL1 now. Follow IBM's instructions, then confirm the faspex-core image reads "5.0.19 (1ce4b13, Fix Pack: 1)." IBM lists no workaround, so there is no safe "wait and see" setting.
- Check for signs of trouble from before you patched. Review the administrator list, new or changed accounts, privilege changes, sharing settings and unusual transfers. Save the logs before anyone cleans up. If something looks wrong, isolate the server and bring in your incident-response contact before deleting anything.
- Clean up outside accounts. Because the flaw starts from an account on the server, remove former employees, finished-project partners and stale guest logins, and require MFA where your setup supports it.
- Keep the admin side off the open internet. Partners may need to reach the transfer page; they don't need your management interface. Limit admin access to your office network or VPN.
- Ask partners who send you Faspex links. If a client, printer or vendor uses Faspex to share files with you, ask whether they've applied IBM's fix. Treat unexpected download links with care, and confirm by phone with someone you know before opening anything that doesn't match a job you're expecting.
- Rotate what the server touches if you find a problem. Change service passwords, storage keys and connected account credentials that the Faspex server uses.
The takeaway for IT decision-makers
File-transfer servers keep showing up on CISA's exploited list because they sit on the internet and hold exactly the files attackers want. If you run Faspex 5, the fix is out and there's no workaround: patch to 5.0.19 PL1, verify the version, and look back for unexpected admin changes. If you only receive Faspex links, make it a vendor question this week. If you'd like help inventorying the file-transfer tools your team and partners use, Brotherly Technology can help.
Sources
- IBM Security Bulletin: IBM Aspera Faspex has addressed a vulnerability that could allow authorization bypass (CVE-2026-123218) (initial publication Nov 7, 2026)
- CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (Nov 9, 2026)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-123218 entry: added Nov 9, 2026, due Nov 12, ransomware use Unknown; CVE-2022-47986 entry: added Feb 21, 2023, ransomware use Known; checked Nov 10, 2026)
- SecurityWeek: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks (Nov 10, 2026)