CVE-2022-47986

CRITICAL9.8

CISA KEV

Published 2023-02-17 · Updated 2026-06-17 · Source psirt@us.ibm.com

Summary

CVE-2022-47986 is a critical-severity (CVSS 9.8) vulnerability in IBM Aspera Faspex. CISA added it to the Known Exploited Vulnerabilities catalog on February 21, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 14, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. IBM has 8 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 8 known-exploited IBM vulnerabilities →

Description

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502

CISA Known-Exploited Vulnerability

Product: IBM — Aspera Faspex

Name: IBM Aspera Faspex Code Execution Vulnerability

Date added: 2023-02-21 · Due: 2023-03-14

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited IBM vulnerabilities

Most recently added to CISA KEV

CVE-2026-9198
Langflow — IBM Langflow Code Injection Vulnerability
added 2026-08-04
CVE-2013-3993
RANSOMWARE
InfoSphere BigInsights — IBM InfoSphere BigInsights Invalid Input Vulnerability
added 2022-05-25
CVE-2015-7450
WebSphere Application Server and Server Hypervisor Edition — IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
added 2022-01-10
CVE-2020-4430
Data Risk Manager — IBM Data Risk Manager Directory Traversal Vulnerability
added 2021-11-03
CVE-2020-4427
Data Risk Manager — IBM Data Risk Manager Security Bypass Vulnerability
added 2021-11-03
CVE-2020-4428
Data Risk Manager — IBM Data Risk Manager Remote Code Execution Vulnerability
added 2021-11-03

View all →

Related CVEs

Same severity, most recent

CVE-2026-18838
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
2026-11-07 · score 9.4
CVE-2026-18836
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
2026-11-07 · score 9.3
CVE-2026-18535
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
2026-11-07 · score 9.6
CVE-2026-17410
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
2026-11-07 · score 9.9
CVE-2026-17409
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
2026-11-07 · score 9.4