CVE-2026-14958
published 2026-07-28CVE-2026-14958: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.82%
56.9th percentile
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aspera_faspex | >= 5.0.0 < 5.0.16 | 5.0.16 |
| ibm | aspera_faspex_5 | 5.0.0 – 5.0.15.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
ghsa_unreviewed·2026-07-28
CVE-2026-14958 [CRITICAL] CWE-78 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
VulDB
IBM Aspera Faspex up to 5.0.15.4 os command injection
vuldb·2026-07-28·CVSS 9.1
CVE-2026-14958 [CRITICAL] IBM Aspera Faspex up to 5.0.15.4 os command injection
A vulnerability was found in IBM Aspera Faspex up to 5.0.15.4. It has been classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to os command injection.
This vulnerability is documented as CVE-2026-14958. The attack can be initiated remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-28
Published