Media operations using IBM Aspera Faspex should check their installations immediately after the Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the file-delivery software to its Known Exploited Vulnerabilities catalog.
The agency added the flaw, tracked as Common Vulnerabilities and Exposures identifier CVE-2026-123218, on November 9. Its catalog entry calls for action under the agency’s security-update guidance and lists November 12 as the due date. That federal remediation date is not a universal deadline for privately owned broadcasters.
IBM’s security bulletin says an authenticated user could send a specially crafted message that bypasses authorization and grants full administrator privileges. Versions 5.0.0 through 5.0.19 are affected. IBM urges customers to upgrade to 5.0.19 PL1 and lists no workaround.
Administrators should not treat an ordinary 5.0.19 installation as patched. IBM says to validate that the faspex-core container image is 5.0.19, build 1ce4b13, with Fix Pack 1, following its container-patching instructions.
Faspex supports file exchange among dispersed teams, making it relevant to broadcasters and production companies that move media between facilities and partners. This warning concerns the specified Faspex versions; it does not establish that every Aspera product is affected.
The catalog confirms exploitation, but the cited public notices do not identify affected broadcasters, describe the scale of attacks or establish use in a ransomware campaign. Media teams should have their system administrator verify the installed build and follow IBM’s remediation guidance.