EUVD-2026-75802
GHSA-j5rw-xw36-2hmr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-priv container execution required; no interaction needed; scope changes to host yielding full C/I/A impact - matches provided vector exactly.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.
AnalysisAI
Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have an existing low-privilege execution context within the IBM Aspera Enterprise WebApps container (PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent: exploitation requires local execution context within the container (AV:L, PR:L), imposes no special complexity or user interaction, and results in a full scope change to the host (S:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch per vendor advisory at https://www.ibm.com/support/pages/node/7286738; consult that page for the specific fixed version, as an exact patched build number was not included in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Aspera Enterprise WebApps and determine which instances are at versions 1.0.0-1.0.5. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today