CVE-2022-47986 CRITICAL

CVE-2022-47986: IBM Aspera Faspex code execution

Vendor Ibm
Product Aspera Faspex
Weakness CWE-502 · Unsafe deserialization
KEV Status Known Exploited
Ransomware Used in campaigns
Published February 17, 2023
Last update October 21, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

CISA mandated remediation

02CISA Required Action

Apply updates per vendor instructions.

Key dates

03Disclosure timeline

February 17, 2023 CVE published
October 21, 2025 Record updated