What happened
CWE-863 incorrect authorization. CISA added CVE-2026-123218 to KEV on 2026-11-09 with confirmed in-the-wild exploitation.
Why it matters
Not AI-specific; included per the KEV coverage rule. Faspex is a file-transfer product, so relevance to AI deployments is indirect, but confirmed ITW exploitation makes it a patching priority.
Attack vector
An authenticated user crafts a specific message that bypasses authorization, causing privilege escalation.
Affected systems
IBM Aspera Faspex
Mitigation
Apply the IBM Aspera Faspex fix per IBM advisory (node 7295921); CISA federal due date 2026-11-12.