IBM Aspera WebApps CVE-2026-92832

Exploitation requires local access to the IBM Aspera Enterprise WebApps host (versions 1.0.0 through 1.0.6) and the ability to observe the specific channel over which the application transmits sensitive data in cleartext; no authentication, elevated privileges, or user interaction is needed (PR:N/UI:N). Limiting factors: the vendor-stated AV:L means remote network attackers cannot exploit it as scored - an attacker must already be local to the system; impact is confined to low confidentiality and low integrity disclosure, not code execution or availability loss. The exact sensitive data exposed and the precise unencrypted channel are not specified in the description and should be confirmed with IBM, especially given the discrepancy between CWE-319 (usually network-interceptable) and the local attack vector.

This is a moderate-to-low real-world priority despite a CVSS base of 5.1 (MEDIUM). The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates an attack requiring LOCAL access with low complexity and no privileges, yielding only low confidentiality and low integrity impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' A notable tension exists: CWE-319 (cleartext transmission of sensitive information) typically implies a network/adjacent interception (AV:N or AV:A) exposure, yet the vendor-supplied vector specifies AV:L (local); this discrepancy should be verified with IBM, as the true attack vector materially changes the risk - if transmission is actually interceptable over the network, the real-world exposure is higher than AV:L suggests. Taken together, the signals describe a low-urgency information-disclosure weakness rather than a high-priority threat: no exploitation evidence, limited impact scope, and a local access requirement all reduce real-world risk, though a vendor patch is available and should be applied during normal maintenance.

A local attacker with access to the host running IBM Aspera Enterprise WebApps (or an attacker able to observe the cleartext channel the application uses) captures sensitive information transmitted without encryption. No public exploit code is available, and per the CVSS vector the attacker needs local access but no prior privileges or user interaction.