IBM Aspera WebApps EUVD-2026-98090

Exploitation requires that the IBM Aspera Enterprise WebApps instance (versions 1.0.0 through 1.0.6) is deployed with JavaScript source map (.js.map) files present and served by the web front-end - the default state for the affected builds per the description - and that the attacker can reach the web interface over the network. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The primary LIMITING factors are: (1) IBM scored the attack vector as Adjacent (AV:A), implying the attacker must be on the same local/logical network segment rather than the open internet - if accurate, this confines exploitation to adjacent attackers; (2) impact is confined to confidentiality of client-side source information (C:L, no integrity or availability effect), so the flaw yields reconnaissance data rather than direct access; and (3) organizations on patched versions or that strip source maps in production are not exposed.

This is a genuinely low-priority issue despite being a 'real' confirmed vulnerability. The CVSS base score of 4.3 (MEDIUM) accurately reflects limited impact: the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates low confidentiality impact only, with no integrity or availability consequence, and the CWE-200 classification (exposure of JavaScript source map files) means an attacker gains visibility into client-side source structure/comments - useful for reconnaissance, not direct compromise. The exposure status is: no public exploit identified at time of analysis (not in CISA KEV, no POC referenced), and no EPSS score was provided in the input, so exploitation probability cannot be quantified. One signal is internally inconsistent and should be verified with the vendor: IBM scored this AV:A (Adjacent network), yet source map file disclosure over a web application is almost always retrievable over the open network (AV:N) via a simple HTTP GET - the Adjacent choice materially lowers the score and may understate reach if the app is internet-facing. No conflicting KEV/EPSS signals exist because neither is present; absence of those signals is consistent with a low-severity informational flaw rather than a widespread threat.

An unauthenticated attacker on a reachable network segment browses the IBM Aspera Enterprise WebApps front-end and requests the referenced JavaScript source map (.js.map) files directly, which the server serves without restriction. The returned maps reveal original un-minified source, file paths, and developer comments, giving the attacker reconnaissance material (internal endpoints, logic, possible secrets) to plan further attacks. No public exploit code is required - this is a trivial direct file retrieval, though CVSS AC:L/PR:N/UI:N make it low-effort for anyone with network access.