CVE-2023-27874: IBM Aspera Faspex

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

Affected products

• IBM Aspera Faspex: up to and including 4.4.2; version 4.4.2 only

Published 2023-03-21. Last modified 2026-06-17.