IBM Aspera Desktop App Arbitrary Code Execution and Path Traversal Vulnerability Bulletin

Vulnerability Overview IBM Aspera Desktop App versions v1.0.5 through v1.0.19 contain multiple vulnerabilities, specifically: 1. CVE-2026-11980 - Description: IBM Aspera Desktop App allows arbitrary code execution at startup by loading a DLL file. - CWE: CWE-242: Use of Inherently Dangerous Function - CVSS Base Score: 7.3 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H 2. CVE-2026-14973 - Description: IBM Aspera Desktop App allows files to be written to locations other than the user-selected download target. - CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVSS Base Score: 9.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/E:H/A:N Affected Products Affected Product: IBM Aspera Desktop App Affected Versions: v1.0.5 - v1.0.19 Remediation IBM strongly recommends immediate remediation via upgrade: Product: IBM Aspera Desktop App Version: 1.1.0 Link: Users can upgrade directly through the application or from IBM Aspera Downloads. Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - Online Calculator v3 - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard intended to convey vulnerability severity and help prioritize response efforts. IBM provides CVSS scores "AS IS" without warranty of any kind, either expressed or implied. The customer is responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM does not guarantee that the products referenced are used by IBM, nor that IBM is aware of the vulnerabilities at the time of referencing. IBM is making a good-faith effort to alert customers to relevant vulnerabilities but may not be able to cover all instances. Referencing unsupported or extended support products and versions does not constitute an obligation by IBM to fix any unsupported or extended support product or version. Document Location Global: - Business Unit: BU059 - Product: SS8NDZ - Component: IBM Aspera - Platform: Windows, Linux, Mac OS - Version: 1.0.8 - Business Line: LOB45 - Business Unit: Automation Platform Feedback Was this helpful?: Users can provide feedback on the document. Document Information: - Date Modified: July 23, 2026 - Initial Release Date: July 23, 2026 - UID: IBM7289939 Share Feedback Need support? - Submit feedback to IBM Support - 1-800-IBM-7378 (USA) - Global contact directory --- Summary: IBM Aspera Desktop App versions v1.0.5 through v1.0.19 contain two severe vulnerabilities. Users are advised to upgrade to version v1.1.0 immediately to remediate these issues.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Aspera Desktop App Arbitrary Code Execution and Path Traversal Vulnerability Bulletin