IBM Aspera Enterprise WebApps EUVD-2026-98087

Exploitation requires the attacker to already have local, low-privileged access to a host running IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6, plus a writable directory that the misconfigured PATH environment variable searches before the trusted system paths. The limiting factors are significant: it is not remotely exploitable (AV:L), it needs valid local credentials or an existing foothold (PR:L), and it depends on the affected version running with the flawed PATH configuration - it cannot be triggered by an unauthenticated or purely remote attacker. No user interaction is required (UI:N) once local access is held.

This is a CVSS 7.8 (HIGH) local privilege-escalation flaw (CWE-426, untrusted/misconfigured PATH search path). The CVSS vector AV:L/AC:L/PR:L/UI:N indicates an attacker needs existing local, low-privileged access to the host, but once present can escalate with low complexity and no user interaction to full C/I/A:H impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this tempers the real-world priority well below internet-facing critical flaws. The score is driven entirely by local impact, not by remote reachability, so prioritization should be scoped to multi-user or shared hosts where untrusted local users exist. Note a tag conflict: the input tags this 'Information Disclosure', but CWE-426 plus the description ('gain elevated privileges') clearly describe privilege escalation, not disclosure - treat the tag as mislabeled.

A low-privileged local user on a host running IBM Aspera Enterprise WebApps (1.0.0-1.0.6) places a malicious executable in a writable directory that appears earlier in the misconfigured PATH than the legitimate binary. When a higher-privileged Aspera process or service invokes a command by name, it loads the attacker's binary and executes it with elevated privileges. No public POC was provided in the input, and exploitation requires pre-existing local access per the CVSS local attack vector.