IBM Aspera Enterprise WebApps CVE-2026-75777

Exploitation requires the attacker to have an existing low-privilege execution context within the IBM Aspera Enterprise WebApps container (PR:L, AV:L). The container must be deployed without a restrictive seccomp syscall filtering policy - specifically, dangerous kernel syscalls must be reachable from within the container namespace. IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 are the only confirmed affected scope. Exploitation is limited by: (1) the requirement for prior code execution inside the container, making this a second-stage attack; (2) the local attack vector, ruling out direct remote exploitation of this specific flaw; and (3) the enterprise deployment context in which untrusted users typically do not have container shell access. A privileged (--privileged) Docker mode is not required - the flaw exists because the container lacks adequate syscall restrictions, not because it was explicitly granted extra capabilities.

The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent: exploitation requires local execution context within the container (AV:L, PR:L), imposes no special complexity or user interaction, and results in a full scope change to the host (S:C). Real-world risk is meaningful but gated on the attacker first obtaining code execution inside the Aspera container - a prerequisite that is non-trivial in a hardened deployment. IBM Aspera is enterprise-grade software not broadly exposed to untrusted users, which limits opportunistic exploitation. No EPSS data was provided; given no KEV listing, no published POC, and the local-access prerequisite, the probability of widespread automated exploitation is low. The scope-changed C:H/I:H/A:H impact means any successful escape delivers full host compromise, elevating the strategic severity for environments running multiple tenants or sensitive workloads on the same host. No conflicting signals detected in the available data.

An attacker who has already obtained low-privilege code execution inside the IBM Aspera Enterprise WebApps container - for example, by exploiting a web application vulnerability in the Aspera web front-end - issues unrestricted kernel syscalls (such as unshare with CLONE_NEWUSER or mount) to break Linux namespace isolation. Once outside the container, the attacker operates with host-level privileges, gaining full control over the underlying server and any co-located workloads. No public proof-of-concept code has been identified at time of analysis.