CVE-2022-47986

IBM Aspera Faspex

Published 17 Feb 2023 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 21 Feb 2023, with a remediation deadline of 14 Mar 2023 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

References

packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html · Third Party Advisory, VDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/243512 · VDB Entry, Vendor Advisory
www.ibm.com/support/pages/node/6952319 · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47986 · US Government Resource