IBM Aspera Faspex 5 CVE-2026-14958

Exploitation requires a valid high-privilege authenticated session on IBM Aspera Faspex 5 (versions 5.0.0-5.0.15.4), confirmed by the CVSS PR:H metric. The vulnerability is network-accessible (AV:N) - no local or adjacent network position is required, only authenticated HTTP/HTTPS access to the Faspex web interface or API. No user interaction by a victim is needed (UI:N). Limiting factors: the attacker must possess or obtain high-privilege credentials (admin-level), which is a substantial pre-condition; SSVC rates the vulnerability as not automatable, meaning unauthenticated mass exploitation is not viable. Organizations where Aspera Faspex admin accounts use shared, weak, or reused passwords face materially higher realistic risk.

The CVSS base score of 7.2 (High) is anchored by full C/H/I/A impact but is substantially limited by PR:H, requiring a high-privilege authenticated session before exploitation is possible - an attacker must already control an administrative account. EPSS at 0.52% (41st percentile) is low, consistent with SSVC's assessment of Exploitation: none and Automatable: no, indicating no known active exploitation and that mass scanning/automation is unlikely. Despite Technical Impact: total in SSVC, the real-world risk is materially lower than a PR:N variant because the attacker must first achieve high-privilege access, which itself represents a significant barrier. This is not a low-CVSS-but-high-real-risk issue in reverse - it is a high-CVSS-but-gated-real-risk issue where the pre-condition (admin auth) is the controlling factor. Priority should be elevated for organizations where Aspera Faspex admin credentials may be exposed, reused, or obtained via phishing/credential stuffing.

An attacker who has obtained high-privilege credentials for IBM Aspera Faspex 5 - through credential stuffing, phishing, or insider access - submits a crafted input containing shell metacharacters (e.g., semicolons, backticks, or $() constructs) to a server-side function that interpolates the value into an unquoted shell command. The server process executes the injected command with the privileges of the Aspera Faspex application user, granting full system access. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward for any attacker who has cleared the authentication barrier.