IBM Aspera Faspex vulnerabilities

49 CVEs affecting IBM Aspera Faspex, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14996, published 2026-07-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-47986: IBM Aspera Faspex Code Execution Vulnerability, published 2023-02-17. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-02-21. EPSS: 100% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete…
CVE-2026-14959, published 2026-07-28. High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
CVE-2023-27874, published 2023-03-21. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary…
CVE-2022-22497, published 2022-05-24. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.
CVE-2023-30995, published 2023-09-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. IBM X-Force ID: 254268.
CVE-2023-27871, published 2023-03-21. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613.
CVE-2023-27873, published 2023-03-21. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654.
CVE-2026-14958, published 2026-07-28. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
CVE-2022-22409, published 2023-09-08. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Force ID: 222592.
CVE-2023-27279, published 2024-04-19. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.

Latest

CVE-2026-14996, published 2026-07-28. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
CVE-2025-36227, published 2026-03-10. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks…
CVE-2025-36226, published 2026-03-10. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2025-36230, published 2025-12-26. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within…
CVE-2025-36229, published 2025-12-26. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVE-2025-36228, published 2025-12-26. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading…
CVE-2025-36225, published 2025-10-09. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
CVE-2025-36171, published 2025-10-09. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.