Aspera Enterprise WebApps EUVD-2026-98088

Exploitation requires local access to a host running IBM Aspera Enterprise WebApps version 1.0.0 through 1.0.6, where a service account has been assigned excessive permissions (CWE-250, execution/resources with unnecessary privileges). The specific over-permissioned resource - whether files, directories, or configuration tied to the service account - is not named in the description and should be confirmed from IBM advisory node/7291755. Limiting factors: the attacker must already possess local access to the system (AV:L), so this is not remotely exploitable over the network; impact is confined to confidentiality (C:H, I:N, A:N), meaning data disclosure only with no modification or denial of service; and the issue is fixed in the vendor-supplied patch, so patched or non-affected versions are not exploitable.

This is a genuinely moderate, not high-priority, issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 6.2 MEDIUM and is driven entirely by a high confidentiality impact with no integrity or availability impact. The local attack vector (AV:L) is the dominant risk-limiting factor: an attacker must already have local access to the host, which sharply narrows real-world exploitability compared to a network-facing flaw. Note a tension in the vector - PR:N (no privileges) combined with AV:L implies any local user, even unprivileged, can read the exposed data, which is plausible for a world-readable/over-permissioned service account resource but is worth confirming against IBM's advisory. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or automated exploitation. SSVC-style reading: exploitation status is 'none', technical impact is partial (confidentiality only), and the local vector makes it non-automatable at scale. Overall this is a 'high-confidentiality-but-locally-gated' issue best treated as routine patching priority rather than emergency response, unless the affected host handles highly sensitive data accessible to many local users.

A local user on a system running IBM Aspera Enterprise WebApps leverages the service account's excessive filesystem or resource permissions to read sensitive information (such as credentials, configuration, or transferred data) that they should not be able to access. Because the CVSS vector is AV:L/AC:L, exploitation requires existing local access but no special privileges or user interaction and is technically simple. No public exploit code was identified at time of analysis.