CVE-2022-47986criticalunder attackransomwareCWE-502

CVE-2022-47986: critical vulnerability in IBM Aspera Faspex

IBM Aspera Faspex code execution

Published · Updated

Follow this CVE+ Monitor Aspera Faspex

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDFeb 17
1st PoCDec 20
CISA KEV+4d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareicefire🇮🇷 leak site
Action required by CISAfederal deadline: 2023-03-14

Apply updates per vendor instructions.

In short

IBM Aspera Faspex contains a flaw that allows attackers to run malicious code on the server by sending specially crafted requests to an outdated API. This is critical because attackers can take full control of the system without needing any special permissions.

Technical detail

A YAML deserialization vulnerability (CWE-502) in IBM Aspera Faspex 4.4.2 PL1 and earlier enables remote code execution through a deprecated API endpoint. An unauthenticated attacker can craft a malicious YAML payload delivered via an obsolete API call to deserialize and execute arbitrary code with system privileges. The vulnerable endpoint was removed in version 4.4.2 PL2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · Aspera Faspex
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — IBM Aspera Faspex

In the same product, most dangerous first.

CVE-2026-123218CRITICALIBM Aspera Faspex Authorization BypassEPSS 0.4%KEVCVE-2023-27874CRITICALIBM Aspera Faspex XML external entity injectionEPSS 1.3%CVE-2022-22497HIGHCVE-2022-22497EPSS 1.2%CVE-2023-30995HIGHIBM Aspera Faspex improper access controlEPSS 0.9%CVE-2023-27871HIGHIBM Aspera Faspex information disclosureEPSS 0.9%CVE-2023-27873MEDIUMIBM Aspera Faspex information disclosureEPSS 0.8%