Actively exploited in the wild
IBM Aspera Faspex Code Execution Vulnerability
IBM - Aspera Faspex · Listed in the CISA KEV since 2023-02-21. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-47986
CriticalCVSS 9.8KEVSummary
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
Risk Assessment
An attacker could remotely execute arbitrary code on the Aspera Faspex server, potentially leading to full system compromise and access to transferred data.
Recommendation
Update IBM Aspera Faspex to version 4.4.2 Patch Level 2 or later, which removes the obsolete API call.
Other vulnerabilities in IBM Aspera Faspex
See all- CVE-2026-14959Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
- CVE-2026-14958Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.
- CVE-2026-14996High
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
Original NVD description (English source)
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.