What is the CVSS score of CVE-2026-14958?

CVE-2026-14958 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM Aspera Faspex 5 are affected by CVE-2026-14958?

IBM Aspera Faspex 5 (versions 5.0.0-5.0.15.4) faces a significant remote command execution vulnerability that could be exploited by compromised administrative accounts to gain complete control of…. A patch is available.

How to fix or mitigate CVE-2026-14958?

Within 24 hours, inventory all IBM Aspera Faspex 5 systems running versions 5.0.0 through 5.0.15.4 and document which accounts hold administrative privileges. Within 7 days, download the patched version from IBM's advisory at https://www.ibm.com/support/pages/node/7280530 and validate compatibility in your test environment before scheduling production deployment. Within 30 days, deploy the patched version to all affected production systems, verify installation success, and implement multi-factor authentication for administrative access to Faspex to reduce the risk of account compromise.

IBM Aspera Faspex 5 CVE-2026-14958

EUVD-2026-50057 HIGH

OS Command Injection (CWE-78)

2026-07-28 ibm

GHSA-3rgm-cxfq-xh5v

RCE Command Injection IBM Aspera Faspex 5

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-accessible endpoint requires high-privilege authentication; once authenticated, unquoted shell interpolation is low-complexity to exploit, yielding full RCE impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 16:07 NVD

CRITICAL HIGH

CVSS changed

Aug 05, 2026 - 16:07 NVD

9.1 (CRITICAL) 7.2 (HIGH)

Analysis Generated

Jul 28, 2026 - 21:21 vuln.today

CVE Published

Jul 28, 2026 - 20:36 cve.org

CRITICAL 9.1

DescriptionNVD

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

AnalysisAI

Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.

Technical ContextAI

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: attacker-controlled input is incorporated into a shell command without proper quoting or escaping, allowing injection of arbitrary shell metacharacters. IBM Aspera Faspex 5, identified by CPE cpe:2.3:a:ibm:aspera_faspex_5, is an enterprise-grade large-file transfer management platform that provides web-based workflows for sending, receiving, and tracking files using IBM's FASP transport protocol. The injection surface exists within server-side functionality accessible to authenticated high-privileged users, where user-supplied values are interpolated into shell commands without sanitization - a classic unquoted variable expansion or unsanitized concatenation pattern in shell scripting or subprocess calls.

RemediationAI

IBM has released a patch addressing this vulnerability; apply the fixed release of IBM Aspera Faspex 5 per the vendor advisory at https://www.ibm.com/support/pages/node/7280530, which is the authoritative source for the exact patched version number (not independently confirmed at time of analysis beyond 'Available'). As a compensating control pending patch deployment, restrict administrative access to Aspera Faspex 5 to a minimal set of trusted accounts and enforce strong multi-factor authentication on those accounts - this directly attacks the PR:H prerequisite that gates exploitation. Additionally, isolate the Aspera Faspex server from broad network access using firewall rules or network segmentation to reduce the exposed attack surface, though note this does not eliminate risk from already-authenticated insiders or compromised admin credentials.