IBM disclosed CVE-2026-14958, a CVSS 9.1 command injection vulnerability in Aspera Faspex 5 that, based on the vendor's scoring, would allow a remote authenticated attacker to execute arbitrary code on the underlying host.
What Is It
CVE-2026-14958 is an OS command injection flaw (CWE-78) in IBM Aspera Faspex 5, disclosed by IBM PSIRT on July 28, 2026. The available data does not detail the specific code path, but a CWE-78 classification typically indicates that user-influenced input reaches a shell context without adequate quoting or sanitization, which would allow an attacker to break out of the intended command and run arbitrary code. The precise root cause has not been published; treat any mechanism-level description as inference from the CWE mapping until IBM's advisory confirms it.
The CVSS 3.1 base score is 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Attack complexity is low and no user interaction is required, but the attacker must already hold high-privilege credentials on the application.
Why It Matters
The scope is marked Changed, meaning successful exploitation is scored as reaching beyond the vulnerable component itself. Combined with the CWE-78 mapping, that implies code execution on the host rather than containment inside the app sandbox; though without a published code path, the exact blast radius should be treated as the vendor's scoring assessment rather than a confirmed outcome. Confidentiality, integrity, and availability impacts are all rated High.
Aspera Faspex is a managed file-transfer platform, which makes it a natural aggregation point for sensitive data in transit. Any RCE in this product class deserves prompt attention even with a privilege prerequisite; high-privilege accounts are frequently obtained through credential theft or misconfigured internal access rather than being genuinely hard to reach.
Note that the privileges-required rating (High) is the main brake on this bug's real-world exploitability. It is not a pre-authentication flaw.
What's Vulnerable
- Product: IBM Aspera Faspex 5
- Affected versions: 5.0.0 through 5.0.15.4 (inclusive)
- Vendor: IBM
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild at this time.
Patch Status
The NVD record for CVE-2026-14958 is in Received status and lists a single vendor reference: IBM Support node 7280530. Consult that advisory for the fixed release and IBM's official remediation guidance; no specific fixed version or required-action deadline is stated in the data available here.
Given the affected range ends at 5.0.15.4, administrators should assume a version later than 5.0.15.4 carries the fix and verify against IBM's advisory before deploying.
Sources
- NVD, CVE-2026-14958: https://nvd.nist.gov/vuln/detail/CVE-2026-14958
- IBM Support Advisory (node 7280530): https://www.ibm.com/support/pages/node/7280530