Actively exploited in the wild
IBM Aspera Faspex Code Execution Vulnerability
IBM - Aspera Faspex · Listed in the CISA KEV since 2023-02-21. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-47986
CriticalCVSS 9.8KEVSummary
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
Risk Assessment
An attacker could remotely execute arbitrary code on the Aspera Faspex server, potentially leading to full system compromise and access to transferred data.
Recommendation
Update IBM Aspera Faspex to version 4.4.2 Patch Level 2 or later, which removes the obsolete API call.
Other vulnerabilities in IBM Aspera Faspex
See all- CVE-2026-14959Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
- CVE-2026-14958Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.
- CVE-2026-14996High
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
- CVE-2025-36230Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2025-36229Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 allow authenticated users to enumerate package identifiers, leading to disclosure of sensitive data information. The vulnerability enables information leakage through identifier guessing.
- CVE-2025-36228Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 may have inconsistent permissions between the user interface and backend API, allowing users to access features that appeared disabled. This could lead to misuse.
- CVE-2025-36171Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
Original NVD description (English source)
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS