What Happened
An IBM Aspera Faspex vulnerability is one of four flaws CISA added to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The Hacker News reports that CISA added the four flaws on Monday. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex. The KEV entry for CVE-2026-123218 describes an incorrect authorization vulnerability in IBM Aspera Faspex, and The Hacker News reports a CVSS score of 9.8 for that CVE.
For an MSP, a KEV listing changes the question from whether a client might be vulnerable to whether someone is already using the flaw. CISA cites evidence of active exploitation, so the window for routine patching has closed for exposed systems. The cost lands on the MSP as emergency response hours, client trust, and time taken away from other work.
The KEV entry for CVE-2026-123218 requires action. CISA's required action says to apply mitigations in accordance with vendor instructions and to follow applicable BOD 26-04 guidance for cloud services, or to discontinue use of the product if mitigations are unavailable.
Timeline
- 2026-11-09: CISA's Known Exploited Vulnerabilities catalog entry for CVE-2026-123218, an IBM Aspera Faspex incorrect authorization vulnerability, is published.
- 2026-11-10: The Hacker News reports that CISA added four security flaws to its KEV catalog on Monday, citing evidence of active exploitation. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex.
Who Is Affected
The four products named by the sources are GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex. MSPs with clients running any of these products need to check exposure. The specific CVE in this advisory, CVE-2026-123218, is in IBM Aspera Faspex.
The CISA KEV description says the IBM Aspera Faspex flaw could allow an authenticated user to craft a specific message to bypass authorization. That detail matters for scoping. The attack path starts with an authenticated user, so accounts and privileges on Aspera Faspex systems are part of the exposure picture.
The sources do not give a number of affected organizations, a specific industry, or a geographic region. Treat the affected group as any organization running the named products until you have checked your own client inventory.
Why the IBM Aspera Faspex Vulnerability Matters to MSPs
CISA's KEV catalog is a list of vulnerabilities with evidence of active exploitation. A high CVSS score alone does not put a flaw on the list. Active exploitation does. The Hacker News reports that CISA added these four flaws citing evidence of active exploitation.
For an MSP, that distinction drives the response order. A CVSS 9.8 flaw with no known exploitation can wait for a maintenance window if no other factor forces the issue. A KEV listing with active exploitation moves to the front of the queue. The practical effect is that patching and mitigation work may pull technicians off scheduled projects. That is the real cost of a KEV addition for many MSPs.
Treat the listing as a trigger to check the four named products in every client environment, not only the ones you remember deploying. Shadow IT and forgotten instances are common in environments that have grown over time.
Technical Details
The CVE is CVE-2026-123218. The product is IBM Aspera Faspex (the CISA KEV entry calls it Aspera Faspex). The Hacker News reports a CVSS score of 9.8. The sources do not list affected versions. The attack vector, as the CISA KEV description states, is that IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
What MSPs Should Do
CISA's required action for this KEV entry is to apply mitigations in accordance with vendor instructions and to follow applicable BOD 26-04 guidance for cloud services, or to discontinue use of the product if mitigations are unavailable. As a standing practice, work exposure first, then mitigation, then verification.
- Inventory every client environment for GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex.
- Determine which instances are internet-facing or otherwise reachable by an attacker. The CISA KEV entry says stakeholders are responsible for evaluating each asset's internet exposure.
- Apply mitigations in accordance with vendor instructions for any affected product.
- If mitigations are unavailable, discontinue use of the product.
- Follow applicable BOD 26-04 guidance for cloud services.
- For IBM Aspera Faspex, review authenticated accounts and privileges, because the described attack path requires an authenticated user.
- As a standing practice, monitor for authorization bypass and privilege escalation attempts and investigate anything unexpected.
- If a client is compromised, isolate the system, preserve evidence, and restore from a clean backup after the root cause is addressed.
How EnterProtect Helps
EnterProtect helps MSPs prepare for the parts of an incident that remain after a flaw is exploited. EnterProtect backup keeps clean, restorable copies of client systems, so an MSP has a known good point to return to. EnterProtect recovery helps get a client running again after a disruptive incident.
EnterProtect vulnerability scanning helps MSPs find exposed software versions across client environments as a general practice, so remediation work can be prioritized. These are standing controls for backup, recovery and exposure management. They are not a substitute for applying vendor mitigations to the products named above.
Frequently Asked Questions
What Is CVE-2026-123218?
CVE-2026-123218 is an incorrect authorization vulnerability in IBM Aspera Faspex. The CISA KEV description says it could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. The Hacker News reports a CVSS score of 9.8 for this CVE.
Which Products Are Affected by the Four Flaws CISA Added to the KEV Catalog?
The four products named in the sources are GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex. CVE-2026-123218 is the IBM Aspera Faspex flaw. The sources in this advisory do not give CVE identifiers for the other three flaws.
Is CVE-2026-123218 Being Actively Exploited?
CISA added the flaw to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The Hacker News reports that CISA added four flaws to the catalog on Monday. A KEV listing means exploitation has been observed, not just that exploitation is possible.
What Should an MSP Do First When a KEV Listing Affects a Client Product?
Check exposure first. Inventory client environments for the named products and determine which instances are reachable by an attacker. Then apply vendor mitigations or discontinue the product if mitigations are unavailable, following CISA's required action.
Does the IBM Aspera Faspex Flaw Require Credentials?
The CISA KEV description says the vulnerability could allow an authenticated user to craft a specific message to bypass authorization. That means the attacker needs a valid account on the affected system. Reviewing accounts and privileges is part of scoping the exposure.
Where Can I Find the Official Details for CVE-2026-123218?
The CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-123218 is the official source in this advisory. The Hacker News also reported on the KEV addition. Use the CISA entry for the required action and the product description.
Sources
- IBM Aspera Faspex Incorrect Authorization Vulnerability (Cisa Kev)
- CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws (Hackernews)