Description
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.
Published: 2026-09-10
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 allow a local attacker to escape container protections because unrestricted system calls are permitted within the container. This weakness is classified as CWE‑269 and could enable elevation of privileges on the host.

Affected Systems

IBM Aspera Enterprise WebApps products, specifically versions 1.0.0 to 1.0.5, are vulnerable. The vulnerability exists across Linux-based installations that deploy the containerized webapps.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity threat, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog. A local attacker can trigger unrestricted system calls to escape container isolation, potentially gaining elevated privileges on the host.

Generated by OpenCVE AI on September 11, 2026 at 03:58 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by upgrading to IBM Aspera Enterprise WebApps 1.0.6 available from the link below ProductFixing VRMPlatformLink to FixIBM Aspera Enterprise WebApps1.0.6 Linux Link https://www.ibm.com/support/fixcentral/swg/selectFixes

OpenCVE Recommended Actions

  • Upgrade IBM Aspera Enterprise WebApps to version 1.0.6 according to IBM’s official instructions.
  • Restrict the container’s system calls by applying a seccomp profile or limiting syscalls to a minimal set to reduce the attack surface for potential escapes.
  • Enable SELinux, AppArmor, or another host‑level mandatory access control policy to enforce additional confinement for the container and its processes.

Generated by OpenCVE AI on September 11, 2026 at 03:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.
Title Multiple vulnerabilities in IBM Aspera Enterprise Webapps
First Time appeared Ibm
Ibm aspera Enterprise Webapps
Weaknesses CWE-269
CPEs cpe:2.3:a:ibm:aspera_enterprise_webapps:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_enterprise_webapps:1.0.5:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aspera Enterprise Webapps
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Aspera Enterprise Webapps
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-11T14:35:45.581Z

Reserved: 2026-08-18T05:22:47.225Z

Link: CVE-2026-75777

cve-icon Vulnrichment

Updated: 2026-09-11T14:35:39.913Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-10T22:16:59.457

Modified: 2026-09-11T15:17:03.843

Link: CVE-2026-75777

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T07:15:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management