CISA added an actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on 2026-11-09. The entry concerns IBM Aspera Faspex and describes an Incorrect Authorization Vulnerability. According to CISA, an authenticated user can craft a specific message that bypasses authorization, leading to privilege escalations. The catalog entry notes that the vulnerability is being actively exploited. CISA’s required action is to apply mitigations in accordance with vendor instructions, while also complying with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and the agency’s “Forensics Triage Requirements”. The notice includes URLs in the notes for further reference. 1