Aspera Faspex 5
Monthly
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.
Arbitrary OS command execution is possible in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) through unquoted shell interpolation, allowing a remote attacker who has already obtained high-privilege authentication to run arbitrary commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:H) confirms network reachability with low attack complexity once authenticated, resulting in full confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via the advisory at https://www.ibm.com/support/pages/node/7280530.
Shell command injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) permits a remote attacker holding high-privilege credentials to execute arbitrary operating system commands on the underlying server. The CVSS 7.2 High score reflects full confidentiality, integrity, and availability impact, substantially gated by the PR:H authentication requirement. No public exploit has been identified at time of analysis, and both EPSS (1.04%, 60th percentile) and CISA SSVC (Exploitation: none) align on low current exploitation activity; a vendor patch is confirmed available.
Improper session expiration in IBM Aspera Faspex 5 allows remote unauthenticated attackers to access sensitive data. The vulnerability, tracked as CVE-2026-14996, affects versions 5.0.0 through 5.0.15.4 and stems from insufficient session invalidation (CWE-613). Attackers who obtain a valid session token can reuse it after the intended lifetime, compromising confidentiality of file transfer data with limited integrity impact.