[CVE-2026-123218] IBM Aspera Faspex — IBM Aspera Faspex Incorrect Authorization Vulnerability

What happened?

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Key details

• Linux Kernel has a missing variable initialization vulnerability affecting page-cache data.
• The flaw occurs when shared-fragment markers are not preserved during socket buffer coalescing.
• ESP input processing decrypts shared fragments in place due to the missing initialization.
• The vulnerability affects an open-source component used across different products.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.