Update: added to CISA KEV. IBM Aspera Faspex has an authorization bypass that an attacker can reach remotely, without logging in, by sending a specially crafted message. This lets the attacker bypass user authorization and gain full administrative privileges, and the bug is listed in CISA's Known Exploited Vulnerabilities catalog, meaning attacks are happening.