What is the CVSS score of CVE-2026-14959?

CVE-2026-14959 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of IBM Aspera Faspex are affected by CVE-2026-14959?

IBM Aspera Faspex 5 (versions 5.0.0-5.0.15.4) contains a HIGH-severity vulnerability that could allow privileged users to fully compromise file transfer servers and intercept sensitive organizational…. A patch is available.

How to fix or mitigate CVE-2026-14959?

Within 24 hours, inventory all IBM Aspera Faspex 5 deployments and identify instances running versions 5.0.0 through 5.0.15.4; immediately restrict high-privilege account access to administrative functions to a minimal set of verified administrators and enable comprehensive audit logging on those accounts. Within 7 days, apply the patch available per vendor advisory to all affected Faspex 5 instances in a staged rollout, beginning with development and testing environments, then proceeding to production during a controlled maintenance window. Within 30 days, complete patching of all systems, verify patch installation across the environment, and review administrative activity logs from the vulnerability window for any suspicious command execution patterns.

IBM Aspera Faspex CVE-2026-14959

EUVD-2026-50055 HIGH

OS Command Injection (CWE-78)

2026-07-28 ibm

GHSA-2h9v-wp82-7j69

RCE Command Injection IBM Aspera Faspex 5

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable (AV:N), no special conditions beyond auth (AC:L), but high-privilege credentials required (PR:H); full triad impact consistent with arbitrary OS command execution; no scope change (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 16:20 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 16:07 NVD

CRITICAL HIGH

CVSS changed

Aug 05, 2026 - 16:07 NVD

9.1 (CRITICAL) 7.2 (HIGH)

Analysis Generated

Jul 28, 2026 - 21:20 vuln.today

CVE Published

Jul 28, 2026 - 20:33 cve.org

CRITICAL 9.1

DescriptionNVD

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.

AnalysisAI

Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.

Technical ContextAI

IBM Aspera Faspex 5 is a web-based managed file transfer portal leveraging IBM's FASP protocol, commonly deployed in regulated industries for high-speed secure file exchange. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied input is passed unsanitized to a system shell interpreter - a well-understood attack class where shell metacharacters such as semicolons, pipes, or backticks allow injecting additional commands beyond the intended operation. The affected CPE cpe:2.3:a:ibm:aspera_faspex_5:*:*:*:*:*:*:*:* confirms only the Faspex 5 product line is in scope; prior major versions (4.x and below) are not covered by this CPE range and should be assessed separately.

RemediationAI

Apply the vendor-released patch for IBM Aspera Faspex 5 per IBM's advisory at https://www.ibm.com/support/pages/node/7280530. The advisory is confirmed available; however, the specific target patched version number is not independently confirmed from available intelligence data - consult the IBM support page directly for the exact upgrade target before deployment. As compensating controls during patch scheduling: restrict administrative access to Faspex to internal networks or VPN-only endpoints, reducing the network-accessible attack surface for privileged accounts; enforce multi-factor authentication on all Faspex administrative accounts to raise the cost of credential compromise; and audit current Faspex admin account membership to enforce least-privilege principles, removing unnecessary high-privilege accounts. Note that network restriction compensates against external attackers but does not mitigate insider or post-breach lateral movement scenarios.