IBM Aspera Enterprise Webapps Vulnerability Advisory (Multiple CVEs)

Vulnerability Overview Multiple vulnerabilities exist in IBM Aspera Enterprise Webapps version 1.0.7, specifically: 1. CVE-2026-75095 - Description: IBM Aspera Enterprise Webapps allows remote attackers to cause a denial of service through uncontrolled resource consumption. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 7.5 2. CVE-2026-75621 - Description: IBM Aspera Enterprise Webapps allows local attackers to obtain sensitive information through excessive permissions granted to service accounts. - CWE: CWE-250: Execution with Unnecessary Privileges - CVSS Base Score: 6.2 3. CVE-2026-92832 - Description: IBM Aspera Enterprise Webapps allows local attackers to obtain sensitive information via plaintext transmission of sensitive data. - CWE: CWE-319: Cleartext Transmission of Sensitive Information - CVSS Base Score: 5.1 4. CVE-2026-75076 - Description: IBM Aspera Enterprise Webapps allows remote attackers to obtain sensitive information by exposing JavaScript source code files. - CWE: CWE-200: Exposure of Sensitive Information to Unauthorized Actors - CVSS Base Score: 4.3 5. CVE-2026-84304 - Description: In the Go language implementation of gRPC-Go, stores each HTTP/2 data frame segment as a separate in . Even when payload bytes remain within connection and flow control windows, millions of single-byte frames consume a disproportionate amount of heap memory. Unauthenticated remote attackers can use concurrent multiplexed streams to exhaust process memory, leading to runtime panics or memory termination. Receive buffer compaction is enabled by default and can be controlled by temporarily setting the environment variable . This issue was fixed in version 1.83.1. - CWE: CWE-400: Uncontrolled Resource Consumption - CVSS Base Score: 8.7 6. CVE-2026-75782 - Description: IBM Aspera Enterprise Webapps allows local attackers to obtain elevated privileges through a misconfigured PATH environment variable. - CWE: CWE-426: Untrusted Search Path - CVSS Base Score: 7.8 Impact Scope Affected Product: IBM Aspera Enterprise WebApps Affected Versions: 1.0.0 - 1.0.6 Operating System: Linux Remediation Fixed Version: IBM Aspera Enterprise WebApps 1.0.7 Platform: Linux Fix Link: Link to Fix Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Information: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer As stated by the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard intended to communicate vulnerability severity and help determine urgency and response priorities. IBM provides CVSS scores "as is" without any express or implied warranties, including but not limited to implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates records for components in its product portfolio and addresses vulnerabilities related to packages not previously identified upon discovery, regardless of the CVE date. The inclusion of an older CVEID does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. We inform customers of relevant vulnerabilities as we become aware of them. The "Affected Products and Versions" referenced in IBM Security Advisories refer only to IBM-supported products and versions that are not end-of-life. Therefore, referencing unsupported or extended support products and versions in this security advisory does not constitute an IBM determination that they are unaffected by the vulnerability. Referencing one or more unsupported or extended support products or versions in this security advisory does not obligate IBM to fix any unsupported or extended support products or versions. Cross-Reference Information Change History October 8, 2026: Initial release Notes CVSS Environmental Score: Customer environment-specific and will finalize the overall CVSS score. Customers can assess the impact of this vulnerability in their environment by accessing the links in the References section of this security advisory.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Aspera Enterprise Webapps Vulnerability Advisory (Multiple CVEs)

More from this source