CVE-2026-14958: IBM Aspera Faspex 5 Shell Injection Enables RCE

Executive Summary

IBM has disclosed CVE-2026-14958, a critical unquoted shell interpolation vulnerability in IBM Aspera Faspex 5, versions 5.0.0 through 5.0.15.4. With a CVSS score of 9.1, this flaw allows a remote authenticated attacker to execute arbitrary code on the server hosting the Faspex platform.

CVSS Score: 9.1 (Critical)

IBM Aspera Faspex is a widely deployed enterprise file transfer platform used by financial, healthcare, media, and government organizations to move large files at high speed. A compromised Faspex instance poses significant data exfiltration and lateral movement risk given the volume and sensitivity of data typically handled by the platform.

Vulnerability Overview

Affected Versions

Technical Analysis

What Is Unquoted Shell Interpolation?

Unquoted shell interpolation is a class of shell injection vulnerability where user-controlled input is passed into a shell command without proper quoting or sanitization. When shell metacharacters (;, |, $(), `, &&, etc.) are included in the input, the shell interprets them as command separators or substitution expressions rather than literal data.

Example of the vulnerable pattern:

# Vulnerable — unquoted variable allows injection
system("process_file " + filename)
 
# If filename = "legitimate.mp4; rm -rf /data"
# Shell executes: process_file legitimate.mp4; rm -rf /data

Exploitation in IBM Aspera Faspex 5

The vulnerability exists in the Faspex 5 server-side processing of file transfer operations. An authenticated user can craft input to a file transfer request that causes the server to execute injected shell commands in the context of the Faspex service account.

Attack Flow

1. Attacker obtains valid Faspex 5 credentials (or compromises a user account)
2. Attacker initiates a file transfer with a crafted payload in the filename or metadata
3. Server-side processing passes the input to a shell command without sanitization
4. Injected shell commands execute as the Faspex service account
5. Attacker achieves RCE — data exfiltration, backdoor installation, lateral movement

Data at Risk

Aspera Faspex is a file transfer platform — exploitation puts in-transit and cached files at risk:

Immediate Remediation

Step 1: Upgrade to IBM Aspera Faspex 5.0.16

# Check current Faspex version
aspera-faspex version
# or
cat /opt/aspera/faspex/VERSION
 
# Stop Faspex services before upgrade
systemctl stop aspera-faspex
 
# Apply IBM-provided upgrade package
# Obtain from IBM Fix Central or Aspera support portal
dpkg -i aspera-faspex_5.0.16_amd64.deb  # Debian/Ubuntu
rpm -Uvh aspera-faspex-5.0.16.x86_64.rpm # RHEL/CentOS
 
# Start Faspex after upgrade
systemctl start aspera-faspex

Step 2: Restrict Authenticated Access While Patching

Limit the attack surface by restricting who can authenticate to Faspex:

1. Suspend non-essential user accounts temporarily
2. Enforce IP allowlisting for authenticated access
3. Enable logging for all transfer operations if not already active

Step 3: Monitor for Exploitation Indicators

# Review Faspex application logs for anomalous shell execution
journalctl -u aspera-faspex --since "2026-07-01" | grep -i "sh\|bash\|exec\|cmd"
 
# Check for unexpected processes spawned by the Faspex service account
ps aux | grep -i aspera
 
# Review files recently created in Faspex temp/work directories
find /opt/aspera/faspex/tmp -newer /opt/aspera/faspex/VERSION -type f

Step 4: Audit Service Account Permissions

Apply least privilege to the Faspex service account:

# Review Faspex service account
id aspera
groups aspera
 
# Remove unnecessary group memberships and sudo access
gpasswd -d aspera wheel  # Remove from sudo group if applicable

Detection Indicators

Post-Remediation Checklist

1. Confirm upgrade to Faspex 5.0.16 or later completed successfully
2. Verify no unauthorized files present in Faspex storage directories
3. Rotate the Faspex service account password and all API credentials
4. Rotate credentials for all connected storage systems (S3, NAS, etc.)
5. Review all Faspex user accounts for unauthorized additions
6. Enable shell auditing (auditd) on the Faspex host for ongoing monitoring
7. Review firewall rules to ensure Faspex admin interfaces are not publicly accessible

References

• IBM Security Bulletin — CVE-2026-14958
• NIST NVD — CVE-2026-14958
• IBM Aspera Faspex Documentation

Related Reading

• CVE-2026-14446: IBM WebSphere Admin Console Privilege Escalation
• CVE-2026-14512: IBM WebSphere Pre-Auth Unsafe Deserialization RCE