What is the CVSS score of CVE-2026-14973?

CVE-2026-14973 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-14973?

Yes, a patch is available for CVE-2026-14973. Update the affected software to the latest version immediately.

Aspera Desktop App CVE-2026-14973

EUVD-2026-50032 CRITICAL

Path Traversal (CWE-22)

2026-07-28 ibm

GHSA-q92f-x3wf-xc2v

Path Traversal IBM Aspera Desktop App

9.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 21:03 vuln.today

CVE Published

Jul 28, 2026 - 20:31 cve.org

CRITICAL 9.3

DescriptionCVE.org

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

AnalysisAI

Path traversal vulnerability in IBM Aspera Desktop App 1.0.5–1.0.19 allows remote attackers to write files outside the user’s intended download directory by enticing a user to interact with a malicious download request or file. No active exploitation or public exploit code has been identified at the time of analysis, and a vendor patch is available.