Four New IBM Aspera Flaws: Faspex 5 and Desktop App, CVE-2026-14958

Four new vulnerabilities have been disclosed in IBM Aspera, the product families organizations use to move large files with outside partners. They landed in the US National Vulnerability Database (NVD) at 21:17 UTC on July 28, 2026. Three of them affect Aspera Faspex 5, the server product that acts as a file exchange portal for external parties, and one affects Aspera Desktop App, the client installed on end users' machines.

On the CVSS 10-point severity scale, the highest is 9.3 and the two Faspex 5 command execution issues are 9.1 each. Fixes are already out: Faspex 5.0.16 and Desktop App 1.1.0, both named explicitly in IBM's official security bulletins (node/7280530 and node/7280939).

The name Faspex may ring a bell. In 2023, a different Faspex flaw (CVE-2022-47986) was used as a ransomware entry point and was added to the US government's catalog of vulnerabilities known to be under attack. There is no evidence that any of the four new issues has been exploited, but this product's history is hard to ignore when you decide how urgently to patch.

This article has been restructured so that IBM Aspera vulnerabilities can be tracked in one place, alongside the five issues disclosed in May (including the two asperahttpd buffer overflows). The May coverage remains in the second half of the page.

What the Four July Vulnerabilities Are

Here is the overview. Every value below was verified against NVD and IBM's official bulletins.

All four CVSS scores were calculated and submitted by IBM itself (NVD lists the source as psirt@us.ibm.com). As of July 29, 2026, NVD still shows the status "Received", meaning NIST has not performed its own analysis. The numbers you see in NVD are, for now, IBM's self-assessment carried through verbatim.

There is one more item you miss if you only watch NVD. The Desktop App bulletin lists a fifth CVE, CVE-2026-11980 (CVSS 7.3): arbitrary code execution through DLL files loaded at start-up, with the same affected versions and the same fix as CVE-2026-14973. Yet that CVE ID has no record in NVD as of July 29, 2026 (the NVD API returns zero results). In other words, there are two reasons to update Desktop App, not one.

Broadcast Material and Production Data All Move Down One Pipe

Faspex plays a different role from an internal file server. Production houses, subcontractors, auditors, translation agencies, print shops — you hand out login accounts to people outside your own company so they can exchange large files safely. Because it is a reception desk, it sits somewhere reachable from the internet, and outsiders log into it as part of daily business.

Production data and broadcast material crossing that desk every day is what a certain trade wants to convert into cash. The regulars are initial access brokers who find nothing but the doorway into a corporate network and resell it to other crews, extortion groups that steal data and demand payment under threat of publication, and fraud operations that impersonate a partner's staff to fish out login credentials. What they look for first is not a specific product flaw but any machine that matches the pattern: outsiders can log in, and it reaches deep inside. Faspex fits that pattern cleanly.

If CVE-2026-14958 or CVE-2026-14959 gets used, what happens is that the server meant to hand files back and forth ends up running the attacker's commands. This is not about stealing one file; it is about taking over the machine that runs the desk. From the victim's side, every exchange that passed through it — who sent what to whom and when — is copied into someone else's hands.

The side that loses its production data and the side that loses the desk holding it face different cleanups. Companies and individuals who entrusted files to the portal see material leak that they never released. The organization running the portal hands over a foothold into its internal network, and then has to explain to every partner that the desk holding their data was taken. That second outcome is precisely what played out in the 2023 Faspex incident described below.

The Three Faspex 5 Issues, One at a Time

All three sit in the same bulletin (node/7280530), first published on July 20, 2026. The fix is Faspex 5.0.16 (Linux), and the "Workarounds and Mitigations" field reads "None" — there is no path around updating.

CVE-2026-14958: Code Execution via Unquoted Shell Interpolation (CVSS 9.1)

IBM's wording: a remote authenticated attacker could execute arbitrary code due to unquoted shell interpolation. Shell interpolation is what happens when a program builds a command line for the operating system and drops a supplied string straight into it. If the interpolated value is not wrapped in quotes, mixing whitespace or shell metacharacters into it turns "one value" into "another command".

S:C (Scope: Changed) in the vector means the impact reaches beyond the vulnerable component, which is consistent with Faspex's internal processing being able to touch OS command execution. Note that IBM left the CWE row blank for this CVE; the CWE-78 classification comes from NVD's record.

CVE-2026-14959: Shell Command Injection (CVSS 9.1)

This one reads: a remote authenticated attacker could execute arbitrary code due to shell command injection. Score, vector, affected versions and fix are identical to CVE-2026-14958, and here IBM assigned CWE-78 itself.

Two separate IDs indicate the same class of defect found in two different places. IBM has not disclosed which screens or APIs are involved, and no reproduction steps have been published. As of July 29, 2026, we found no sign of public proof-of-concept code for either issue.

CVE-2026-14996: Session Management Flaw (CVSS 8.2, Details Withheld by IBM)

This entry is different in kind. IBM's description is only: "IBM Aspera Faspex 5 has addressed a vulnerability related to session management." Nothing is said about what happens, or what an attacker can do. Filling that gap with guesses would be wrong, so what follows is limited to what could be verified.

Even with an empty description, the numbers say something. CWE-613 means insufficient session expiration: the token that represents a logged-in state does not stop working when it should. The vector requires no privileges (PR:N) and no user interaction (UI:N), with high confidentiality impact (C:H). The reading that follows is that this is the only one of the three Faspex issues that needs no authentication, and that it concerns reading information.

Beyond that, nothing can be written. Which operation exposes which data, whether old sessions can be picked up, whether a token still works after logout — IBM explains none of it. The fact that the vendor is not explaining is itself information a reader deserves. We will update this article when details appear.

How High Is the "Authenticated" Bar on Faspex?

CVE-2026-14958 and CVE-2026-14959 both require a login, so it is true that this is not a case of anyone walking in from outside. It is equally true that the set of people who can log in is wider here than on an ordinary server. Handing accounts to external partners is the intended way to use Faspex, and IBM's product page positions it as a portal for distributing and receiving files. Realistically, every account is a potential starting point.

That said, there is a tension in the numbers, and naming it avoids overstating the risk. IBM's prose says "remote authenticated attacker", but the CVSS vector says PR:H — high privileges required. Under the CVSS definitions, PR:H means administrator-level rights, and an issue reachable by an ordinary user would be scored PR:L. Read IBM's own scoring literally and these two issues do not work from a single regular account handed to a partner; they need an account with administrative privileges.

IBM never addresses that distinction in its prose, so public information cannot settle it. The practical conclusion: if administrator credentials are reused or leaked, this immediately becomes a 9.1-grade problem, and if administrator accounts are tightly held, the difficulty rises. Either way, plan the update on the understanding that the cost of leaking admin rights on a portal serving external users just went up a notch.

Two More on the End User's Machine (Aspera Desktop App)

CVE-2026-14973 differs in nature from the other three. The target is not a server but the PC receiving files through Aspera. Aspera Desktop App (IBM Aspera for desktop) is the next-generation transfer client IBM announced for December 2024 as the successor to the browser-extension-based Aspera Connect. Per IBM's own announcement, it lets users attach Aspera on Cloud, HSTS, or Faspex 5 accounts to browse and receive content, and it supports automatic package downloads. It is, in short, the app that is moving onto the desktops of everyone who works with Faspex.

CVE-2026-14973: Files Can Be Written Outside the Chosen Destination (CVSS 9.3)

IBM's wording: "IBM Aspera for desktop can allow files to be written outside of the user's selected download destination." The classification is CWE-22, path traversal — the classic trick of embedding "go up one level" sequences in a file name so that the file lands outside the folder the user picked.

The 9.3 comes from S:C (impact escapes the app) plus high confidentiality and integrity impact (C:H/I:H). At the same time UI:R is set, so the user has to act — most likely by receiving a file or package. From an attacker's side, that means the ordinary business motion of sending a partner a file through Faspex is the precondition.

What follows is speculation. Being able to write outside the chosen folder suggests configuration files or auto-start folders as write targets, and if that works, attacker code would run at the next reboot or app launch. But IBM does not say any of this in the bulletin. What is written stops at "files can be written outside the selected destination", with no account of what comes next. Treat the above as an inference from how path traversal usually plays out, nothing more.

CVE-2026-11980: Code Execution via DLL Loading at Start-up (CVSS 7.3, Absent From NVD)

This one appears alongside it in the same bulletin (node/7280939, first published July 23, 2026). IBM's wording: "IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up." The classification is CWE-242 and the vector is AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H for CVSS 7.3.

Because the attack vector is local (AV:L), this concerns someone who can touch the machine or already has a foothold on it. The premise differs from the remotely reachable CVE-2026-14973, but the affected versions and the fix are the same, so one update handles both. As noted, it is absent from NVD, which means vulnerability management tooling that only consumes NVD will not flag it. IBM publishes fixes in bulletin-sized bundles, and this is a concrete case where tracking bulletin numbers rather than CVE IDs loses less. A larger-scale example of the same bundling is IBM WebSphere Application Server's simultaneous disclosure of fourteen issues — bigger than a single CVE covering several flaws, the bundling unit itself is larger there.

Version Reference Table for Aspera Products (2026 Disclosures)

Here is every 2026 IBM Aspera vulnerability laid out per product. Find the row that matches the version you run.

Two caveats about the table. First, CVE-2026-7876 spans two bulletins. The HSTS/HSTE bulletin (node/7273615) gives the affected range as 3.7.4 through 4.4.7 Fix Pack 1, while NVD's record and the Cloud Pak for Integration bulletin (node/7274127) give CP4I 1.5.1 through 1.5.19. The same CVE ID describes products and versions differently, so both need checking.

Second, the Faspex 5 bulletin also carries eleven CVEs inherited from open-source components (seven Nokogiri issues, two js-yaml, one fast-uri, plus the withdrawn CVE-2026-38969). Those are resolved by the same Faspex 5.0.16 release, so when you take the change through internal review, describing it as "one update that clears fourteen findings" rather than "three Faspex issues" tends to land better.

Faspex's Record, and Where the Line Sits Today

Faspex has form. In February 2023, CVE-2022-47986 in the Faspex 4 line (a YAML deserialization flaw, CVSS 9.8) was attacked within days of disclosure and was added to CISA's Known Exploited Vulnerabilities catalog on February 21, 2023. The KEV entry states knownRansomwareCampaignUse: Known. The remediation deadline for US federal agencies was March 14, 2023 — three weeks. Reporting at the time tied it to the IceFire ransomware operation.

Now the line. As of July 29, 2026, there is no evidence anywhere that the four new issues (or the fifth one in the Desktop App bulletin) have been exploited. We checked the current KEV catalog (catalogVersion 2026.07.27, 1,655 entries): the only Aspera entry is still CVE-2022-47986 from 2023. Even CVE-2026-8175 (CVSS 9.8) from May is not in KEV. "Faspex again" is a real pattern, but it is a different statement from "under attack right now".

We also looked at EPSS, which estimates exploitation likelihood mechanically. As of July 28, the four new CVEs have no EPSS score yet, since they were published the same day. The May issues do: CVE-2026-8175 at 0.58% (44.3rd percentile), CVE-2026-8179 at 0.40%, CVE-2026-8180 at 0.32%, CVE-2026-9035 at 0.33%. As probabilities of exploitation within 30 days, those are low. A CVSS of 9.8 and an EPSS of 0.58% are both correct and describe different things: how much it hurts if it hits, versus how often it hits.

Whether these four end up in KEV can be tracked on our CISA KEV dashboard. Given the precedent, a fast addition cannot be ruled out if exploitation is observed.

Absent From JVN and From the Japanese Press

We checked JVN iPedia, Japan's national vulnerability database. As of July 29, 2026, none of the four new CVEs (CVE-2026-14958 / 14959 / 14973 / 14996) is registered there. The May issues are: JVNDB-2026-018497 (CVE-2026-8175) and JVNDB-2026-018496 (CVE-2026-8179), both dated June 8, 2026. That is roughly a two-week lag behind NVD; at the same pace, the July batch would appear in early August.

We found no JPCERT/CC alert and no IPA advisory covering the four, and no Japanese-language news or technical write-up either. Outside Japan the picture is similar: the CERT-FR advisory on IBM products published July 24 (CERTFR-2026-AVI-0933) does not include the Aspera bulletins at all — it covers AIX, QRadar, Sterling, WebSphere Application Server Liberty and others. For the May batch, the Dutch NCSC issued NCSC-2026-0178 on June 8, but we found no equivalent advisory for the July Aspera issues.

The July Aspera batch has slipped through the national advisory nets. IBM published the bulletins on July 20 and 23, and NVD reflected them on July 28. Around the same July 28 window, fourteen vulnerabilities were also disclosed for IBM WebSphere Application Server, and attention went to the larger pile while Aspera sank. For cross-vendor tracking of enterprise vulnerabilities in Japan, see also our roundup of critical vulnerabilities for Japanese enterprises.

For the record, the May issues were reported by Dutch security researcher Yannik Marchand (HackerOne: kinnay), credited by name in IBM's bulletins. He also took down a Kenwood head unit with a single out-of-bounds write at Pwn2Own Automotive in January 2026 for a $20,000 award. For the four July issues, IBM's acknowledgement section is blank and no reporter has been named. We also found no posts about them from the researcher or from IBM staff on X.

Faspex 5 or the End-User Side: Which to Patch First

1. Move Faspex 5 to 5.0.16. The affected range runs from 5.0.0 to 5.0.15.4, so being on the newest 5.0.15.x still counts. IBM lists workarounds as "None", so updating is the only option offered. For a system that operates as an external-facing portal, this belongs at the front of the maintenance-window queue.

2. Move Desktop App to 1.1.0. Affected: 1.0.5 through 1.0.19. IBM's bulletin says users can upgrade directly inside the application or from IBM Aspera Downloads. The app supports automatic updates, so rollout is comparatively easy even across many machines. Inventory the endpoints already migrated off the old Aspera Connect and check their versions.

3. Audit Faspex administrator accounts. As covered above, IBM's own scoring puts CVE-2026-14958 and CVE-2026-14959 behind high privileges. Cutting the number of admin accounts, turning on multi-factor authentication, and clearing rights left behind by departures and transfers is the practical mitigation for these two.

4. Review external user accounts and sessions. CVE-2026-14996 is a session management flaw with no published detail. For a vulnerability whose behavior is unknown, patching is the only reliable answer. Until then, avoid keeping sessions logged in indefinitely and stop using shared accounts.

5. If HSTS / HSTE is below 4.4.7 Fix Pack 2, clear that first. The May batch includes CVE-2026-8175 at CVSS 9.8 with no authentication required, which will outrank Faspex in many environments. If you are batching database maintenance into the same window, consider whether the IBM Db2 patch work can ride along.

How the Disclosures Unfolded

← Swipe to navigate

How Far IBM's Own Text Backs This Up

What Is IBM Aspera?

Aspera is a high-volume file transfer software originally developed by Aspera Inc. of the United States, which IBM acquired in 2014. Where standard TCP might deliver only a few MB/sec across intercontinental links, Aspera's proprietary FASP protocol can sustain multi-GB/sec transfer speeds, positioning it as IBM's flagship transfer platform.

Common deployment scenarios include:

• Broadcasters exchanging video material (tens of GB of uncompressed footage) between sites
• Film studios shuttling dailies with overseas VFX houses
• Financial institutions running large overnight batch transfers of trading data
• Pharma and scientific organizations sharing massive files such as genomic analysis data
• Government agencies distributing geospatial information and satellite imagery internationally

The family splits into several products. HSTS (High-Speed Transfer Server) and HSTE (Endpoint) form the transfer foundation, Faspex provides the web portal for exchanges with outside parties, and Desktop App is what users install locally. This article covers all three.

In 2023, the European Broadcasting Union (EBU) published a piece warning that "the Aspera vulnerability is a cautionary tale for the broadcast industry". The product is indispensable infrastructure for broadcast operations, but it has also repeatedly drawn attention as an attack surface.

The Five Issues Disclosed in May (HSTS / HSTE)

What follows is the content of bulletin node/7273615, published by IBM on May 21, 2026. It covers HSTS and HSTE from v3.7.4 through v4.4.7 Fix Pack 1. The fix is 4.4.7 Fix Pack 2, which resolves all five at once. The defects live in asperahttpd, a small HTTP server component bundled with Aspera.

CVE-2026-8175: Heap Buffer Overflow (CVSS 9.8, Unauthenticated)

This is the most severe of the five. NVD classifies it as CWE-122 (heap-based buffer overflow). Sending a specially crafted HTTP request to asperahttpd causes memory to be written past the boundary of the heap region (where the program dynamically allocates memory).

A heap buffer overflow is the classic bug class in which the contents written past the boundary let an attacker hijack the program's execution path. IBM's bulletin lists the impact as denial of service, authentication bypass, and arbitrary code execution, in that order. The last of those means an attacker gaining a presence on the file transfer server itself.

Aspera servers at broadcasters and financial institutions are frequently exposed to the internet by the nature of the work (receiving material from partners, exchanging with overseas sites). Since CVE-2026-8175 needs no prior authentication, knowing the server's URL and port is enough for a direct attack.

CVE-2026-8179: Stack Buffer Overflow (CVSS 8.8, Authenticated)

This one is a buffer overflow in the stack region (where temporary data for function calls is kept) of the same asperahttpd. NVD classifies it as CWE-121. The 8.8 score sits below CVE-2026-8175 purely because an authenticated user is required; past that point, the behavior also reaches arbitrary code execution.

The authentication requirement makes the impact look smaller at first glance, but Aspera is a product where accounts get issued to people across multiple sites and multiple companies. If an external partner's or contractor's account is compromised, that low-privileged account becomes a route to privilege escalation on the server itself. From the Aspera administrator's chair, every external account issued is another possible starting point for CVE-2026-8179.

CVE-2026-7876: Authentication Bypass to Files on the Server (CVSS 9.1)

IBM's wording: a transfer client may be able to access files in the server's local storage that it should not have access to, when specific restriction settings are not in place. The classification is CWE-287 (improper authentication) and the vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Requiring no authentication puts it alongside CVE-2026-8175 in terms of exposure.

As noted above, this is the one issue covered by two bulletins. The fix is 4.4.7 Fix Pack 2 for HSTS/HSTE and 1.5.20 for the Cloud Pak for Integration edition. The "when specific restriction settings are not in place" condition means some environments may not be affected, but IBM does not name which settings it means.

CVE-2026-8180: Unauthenticated Service Crash (CVSS 7.5)

"An unauthenticated user can cause the asperahttpd service to crash", classified as CWE-476 (NULL pointer dereference). This is not about running code; it is about knocking out the transfer endpoint. In environments running deadline-bound transfers, as in broadcast or settlement work, downtime alone is the business damage.

CVE-2026-9035: Authenticated Read of Other People's Files (CVSS 6.5)

"An authenticated user may be able to access files in the server's local storage that they should not have access to", classified as CWE-22 (path traversal). At 6.5 it is the lowest of the five, but in a deployment that hands accounts to outside parties, this is the kind of defect that turns into "partner A's account can read partner B's files".

All five were reported by Dutch security researcher Yannik Marchand and credited in IBM's bulletins. JVN iPedia registered them in June 2026.

Value Concentrated in Motion

A FASP pipe that carries several GB per second looks, from an attacker's vantage point, more like the loading dock of a vault than a piece of middleware. The buyers for that dock's key are not curious tinkerers. They are extortion crews that yank pre-release drama and theatrical masters and pair encryption with a public leak threat, initial access brokers who slice up footholds into broadcast and film studios for resale, revenue-driven state-aligned operators chasing dailies traded with overseas VFX houses, industrial spies who want to read overnight settlement batches at banks, state-backed groups hunting raw clinical-trial data at pharma companies, and outgoing employees lifting material on their way out. What they actually want is not the file server at rest but the value concentrated in motion: the final edit master, the settlement line items, the genome assemblies, the satellite-image deltas.

From the initial access broker's product catalog, CVE-2026-8175 is a near-ideal item. An unauthenticated jump to administrator-equivalent access, a stable one-shot trigger, and an install base skewed toward sectors — broadcast, finance, pharma — that have the cash flow to pay ransoms. That combination is why the access itself gets resold to extortion crews rather than burned on a noisy direct code execution. What plays out at the other end is the familiar two-act: encryption, then a public leak. In broadcasting, even minutes of unreleased footage collapse box-office and licensing negotiations; in pharma, leaked trial data can derail approval timelines entirely. The European Broadcasting Union's 2023 framing of the Aspera flaw as a warning to the industry anticipated exactly this extortion architecture.

On paper, CVSS 9.8 marks the technical ceiling of severity. What hurts broadcasters, banks, and pharma is not the server going down — it is that unreleased masters with script context, raw payment ledgers, raw clinical readings, and satellite imagery, assets that never sit together in one place except for the seconds they spend on the wire, fall in a single motion into the hands of competitors and extortion crews. The four July issues in Faspex 5 and Desktop App do not change what needs protecting.

Update History

References

• ▸ IBM Security Bulletin - Multiple vulnerabilities in IBM Aspera Faspex (node/7280530) (July 20, 2026)
• ▸ IBM Security Bulletin - Multiple vulnerabilities in IBM Desktop App (node/7280939) (July 23, 2026)
• ▸ IBM Security Bulletin - Multiple vulnerabilities in Aspera applications (node/7273615) (May 21, 2026)
• ▸ IBM Security Bulletin - Aspera HSTS for Cloud Pak for Integration (node/7274127) (May 26, 2026)
• ▸ NVD - CVE-2026-14958 Detail
• ▸ NVD - CVE-2026-14959 Detail
• ▸ NVD - CVE-2026-14973 Detail
• ▸ NVD - CVE-2026-14996 Detail
• ▸ CVE.org - CVE-2026-14958 Record
• ▸ NVD - CVE-2026-8175 Detail / CVE-2026-8179 / CVE-2026-8180 / CVE-2026-9035 / CVE-2026-7876
• ▸ CISA - Known Exploited Vulnerabilities Catalog (CVE-2022-47986 entry and its ransomware usage record)
• ▸ FIRST - EPSS (Exploit Prediction Scoring System)
• ▸ JVN iPedia - JVNDB-2026-018497 (CVE-2026-8175)
• ▸ NCSC-NL - NCSC-2026-0178 (the five Aspera HSTS / HSTE issues)
• ▸ CERT-FR - CERTFR-2026-AVI-0933 (multiple IBM product vulnerabilities; Aspera not included)
• ▸ IBM - IBM Aspera for desktop, release announcement
• ▸ SecurityWeek - Recently Patched IBM Aspera Faspex Vulnerability Exploited in the Wild (CVE-2022-47986)
• ▸ EBU Technology & Innovation - The Aspera vulnerability: a cautionary tale for the broadcast industry
• ▸ Yannik Marchand - LinkedIn / HackerOne: kinnay (reporter of the May issues)