IBM Aspera Faspex EUVD-2026-118902

Exploitation requires the ability to send a specifically-crafted message to IBM Aspera Faspex version 5.0.0 through 5.0.19; the description scopes this to 'an authorized user', so a valid Faspex account appears to be a prerequisite despite the input CVSS vector listing PR:N - this is the primary limiting factor and should be confirmed with IBM. The exact message format and the feature whose authorization check is flawed are not described in the available sources. No user interaction by a victim is needed, and the flaw yields full administrative privileges once triggered. Versions outside 5.0.0-5.0.19 are not listed as affected.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 and the vuln.today decision label is 'act_now', with a vendor patch already available. However, there is a clear internal conflict that defenders must resolve: the CVSS vector encodes PR:N (no privileges required), yet the IBM description explicitly states the flaw 'could allow an authorized user' to bypass authorization - implying at least a valid, authenticated account (PR:L). This should be verified with the vendor; if authentication is genuinely required, the practical attack surface narrows to users who already hold Faspex accounts, which lowers real-world exploitability versus a fully anonymous network attack. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The CVE is not listed in CISA KEV and no POC reference is supplied, so there is no evidence of active exploitation or public exploit code. Weighing the signals: impact is severe (full administrative takeover of a file-transfer platform, CWE-863 Incorrect Authorization) and a patch exists, so prompt remediation is warranted per the act_now label - but the PR:N-versus-'authorized user' discrepancy means the raw 9.8 likely overstates the barrier-to-entry and should be read as closer to an authenticated privilege-escalation-to-admin issue.

An attacker holding a valid (likely low-privileged) Faspex 5 account crafts a specifically-formed message that the authorization logic fails to properly check, causing the application to grant the attacker full administrative privileges. With admin access to the file-transfer platform, the attacker can read, alter, or exfiltrate transferred files and reconfigure the system. No public exploit code or POC reference was provided in the input.