ZeroDay Findings
Sign inSign up

Findings

CVE-2022-47986

IBM Aspera Faspex Code Execution Vulnerability

Published Feb 17, 2023 · updated Jun 16, 2026 · ibm aspera faspex

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 17, 2023 · Catalog

    Detected

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

  2. Feb 21, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 14, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Required action

Apply updates per vendor instructions.

CISA due date Mar 14, 2023

Affected

  • cpe ibm/aspera faspexversion unspecified
  • cpe ibm/aspera faspex4.4.2
  • vendor IBM Aspera Faspexversion unspecified

Sources

  • CISA KEVCVE-2022-47986

    IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.

    cisa.gov
  • CVE.orgCVE-2022-47986

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-47986

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database51316

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2022-47986

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2022-47986 · ZeroDay Findings