Description
IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
Published: 2026-11-08
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Account Configuration Modification
Action: Patch Now
AI Analysis

Impact

IBM Aspera Connect versions 1.6.1 through 4.2.19 do not consistently enforce origin verification on all REST API endpoints. An attacker who tricks a user into visiting a malicious website could leverage this flaw to delete or view the user's account configuration data, compromising integrity and potentially exposing sensitive information.

Affected Systems

The vulnerability affects IBM Aspera Connect for Linux, Mac OSX, and Windows deployments from version 1.6.1 up to 4.2.19.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. The exploit requires social engineering to lure a user to a malicious site and is feasible once the user runs a targeted request. Because the flaw resides in the client application, exploitation is limited to machines where the affected Aspera Connect version is installed. The issue is not listed in the CISA KEV catalog, and the EPSS score is unavailable, suggesting limited current threat intelligence.

Generated by OpenCVE AI on November 8, 2026 at 18:25 UTC.

Remediation

Vendor Solution

It is recommended to apply the fix as soon as possible, see links in the table below. ProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20 Linux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20 Mac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20 Windows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes

OpenCVE Recommended Actions

  • Upgrade IBM Aspera Connect to version 4.2.20 or later on all affected systems.
  • If an immediate upgrade is not possible, restrict REST API access to trusted origins by configuring the client or network firewall to permit traffic only from known domains.
  • Monitor Aspera Connect logs for unexpected configuration changes or unauthorized API calls and investigate any anomalies promptly.

Generated by OpenCVE AI on November 8, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Description IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
Title Multiple vulnerabilities in IBM Aspera Connect
First Time appeared Ibm
Ibm aspera Connect
Weaknesses CWE-862
CPEs cpe:2.3:a:ibm:aspera_connect:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_connect:4.2.19:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aspera Connect
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

Subscriptions

Ibm Aspera Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T17:12:28.376Z

Reserved: 2026-10-30T20:55:57.874Z

Link: CVE-2026-120115

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T18:17:00.990

Modified: 2026-11-08T18:17:01.100

Link: CVE-2026-120115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T18:30:11Z

Weaknesses