EUVD-2026-98089
GHSA-mxxx-63r9-2g9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Aspera WebApps endpoint
-
ExploitSend resource-exhausting requests
-
ExecutionTrigger uncontrolled resource consumption
-
ImpactDeny service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an IBM Aspera Enterprise WebApps instance running an affected version (1.0.0 through 1.0.6); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is stated as required - remote unauthenticated requests can trigger the uncontrolled resource consumption. The primary limiting factor is exposure: instances not reachable from an untrusted network are not remotely exploitable, and the impact is confined to availability (service disruption) with no confidentiality or integrity effect. The specific request pattern or resource that is exhausted is not detailed in the description - verify the exact trigger with IBM advisory node/7291755. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and high availability impact - the 7.5 base score is driven entirely by the DoS outcome, which is consistent with CWE-400 (uncontrolled resource consumption). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit (POC) is referenced, so there is no evidence of active or demonstrated exploitation. This profile - easy to reach but availability-only impact and no code execution or data exposure - makes it a moderate operational-resilience concern rather than a top-tier breach priority: a successful attack degrades or disrupts the Aspera transfer service but does not compromise data or grant access. Priority should be weighted by how business-critical the affected Aspera file-transfer service is to the environment; where it is a core transfer dependency, patching is warranted, but this is a high-CVSS availability issue rather than a confirmed widespread-exploitation emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted or high-volume requests to an exposed IBM Aspera Enterprise WebApps instance (versions 1.0.0 through 1.0.6), causing the application to consume excessive resources (CPU, memory, or connections) until the service becomes unresponsive. No public exploit code is referenced, and the attack yields service disruption only - not data access or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Remote unauthenticated attackers can cause a denial of service in IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 by exhausting resources through uncontrolled resource consumption (CWE-400). The flaw is network-reachable with low complexity, requires no privileges or user interaction, and results in high availability impact, yielding a CVSS 3.1 base score of 7.5. No public exploit code has been identified at time of analysis, and IBM has released a patch.
RemediationAI
Apply the vendor patch referenced in IBM advisory node/7291755; the advisory should specify the fixed version. Until patching is possible, restrict network access to the Aspera Enterprise WebApps interface to trusted networks or authenticated users only-this reduces exposure but does not eliminate the vulnerability for legitimate users. Implement rate limiting or resource quotas at a reverse proxy or load balancer to mitigate the impact of resource exhaustion, though tuning may be required to avoid blocking legitimate traffic. Monitor for abnormal resource consumption (CPU, memory, connection counts) and restart the service if needed. No public exploit code is known, so generic attack signatures are unlikely to be effective.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Aspera Enterprise WebApps is a web-based interface for managing and monitoring Aspera high-speed transfer solutions. The CPE cpe:2.3:a:ibm:aspera_enterprise_webapps:*:*:*:*:*:*:*:* indicates that all versions through 1.0.6 are affected. The root cause falls under CWE-400 (Uncontrolled Resource Consumption), meaning the application fails to properly limit or throttle the allocation of a resource-such as memory, CPU, threads, or file descriptors-when handling crafted remote requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack is network-based, requires no authentication or user interaction, and results in a complete loss of availability without affecting confidentiality or integrity. The specific resource exhausted and the exact request pattern are not detailed in the CVE description; the IBM advisory should be consulted for the precise trigger.
Know when Aspera Enterprise Webapps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity DoS with no confidentiality or integrity impact and high availability impact, consistent with CWE-400.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Executive ViewAI
IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 are vulnerable to a remote denial-of-service attack that can exhaust system resources, potentially disrupting critical file transfer operations. Although no public exploit code has been identified at time of analysis, the flaw is network-reachable with low complexity and high availability impact, making it a significant operational risk for organizations relying on this platform. Leadership should prioritize patching to maintain service continuity and protect against potential downtime.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Aspera Enterprise Webapps
View allContainer escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the con
Local privilege escalation in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 stems from a misconfigured PATH environm
Local information disclosure in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 allows an attacker who already has acc
Cleartext transmission of sensitive information in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 can allow a local a
Exposure of JavaScript source map files in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 lets remote attackers retri
Exploit-DB