High · 8.8 CVE-2025-13481 EUVD-2025-202871GHSA-82p3-cwp7-9pjw

IBM Aspera Orchestrator Command Injection

Published Dec 11, 2025 · Updated Dec 11, 2025 · Assigned by ibm

Vendor: IBM Product: Aspera Orchestrator

Description

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

Affected products

Vendor	Product	Affected	Fixed
IBM	Aspera Orchestrator	4.0.0 – ≤ 4.1.0	—

References

https://www.ibm.com/support/pages/node/7254434 vendor-advisory patch