CVE-2026-75777

Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Published Sep 10, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.

Analysis

Technical impact

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 allow a local attacker to escape container protections because unrestricted system calls are permitted within the container. This weakness is classified as CWE‑269 and could enable elevation of privileges on the host.

Affected Systems

IBM Aspera Enterprise WebApps products, specifically versions 1.0.0 to 1.0.5, are vulnerable. The vulnerability exists across Linux-based installations that deploy the containerized webapps.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity threat, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog. A local attacker can trigger unrestricted system calls to escape container isolation, potentially gaining elevated privileges on the host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Aspera Enterprise WebApps

affected

Version	Status	Constraints
`1.0.0`	affected	≤ 1.0.5

No data.

Vendor Product Versions

Ibm

Aspera Enterprise Webapps

Version	Status	Scheme	Platform
`[1.0.0,1.0.5]`	affected	semver	—

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerabilities now by upgrading to IBM Aspera Enterprise WebApps 1.0.6 available from the link below ProductFixing VRMPlatformLink to FixIBM Aspera Enterprise WebApps1.0.6 Linux Link https://www.ibm.com/support/fixcentral/swg/selectFixes

OpenCVE Recommended Actions

Upgrade IBM Aspera Enterprise WebApps to version 1.0.6 according to IBM’s official instructions.
Restrict the container’s system calls by applying a seccomp profile or limiting syscalls to a minimal set to reduce the attack surface for potential escapes.
Enable SELinux, AppArmor, or another host‑level mandatory access control policy to enforce additional confinement for the container and its processes.

Generated by OpenCVE AI on September 11, 2026 at 03:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.149% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.ibm.com/support/pages/node/7286738

History

Sep 11, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 10, 2026 10:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.
Title		Multiple vulnerabilities in IBM Aspera Enterprise Webapps
First Time appeared		Ibm Ibm aspera Enterprise Webapps
Weaknesses		CWE-269
CPEs		cpe:2.3:a:ibm:aspera_enterprise_webapps:1.0.0:::::::* cpe:2.3:a:ibm:aspera_enterprise_webapps:1.0.5:::::::*
Vendors & Products		Ibm Ibm aspera Enterprise Webapps
References		https://www.ibm.com/support/pages/node/7286738
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`