Critical · 9.1 CVE-2026-14958 EUVD-2026-50057GHSA-3rgm-cxfq-xh5v

OS command injection in IBM Aspera Faspex

Published Jul 28, 2026 · Updated Jul 30, 2026 · Assigned by ibm

Description

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

Vendor	Product	Affected	Fixed
IBM	Aspera Faspex 5	5.0.0 – ≤ 5.0.15.4	—