CVE-2023-27286: IBM Aspera code execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-02 · updated 2026-06-17
Weakness: CWE-119

Description

IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616.

Affected products

IBM Aspera Cargo: before 4.2.5 — fixed in 4.2.5
IBM Aspera Connect: before 4.2.5 — fixed in 4.2.5

How to fix

Upgrade to a fixed version: IBM Aspera Cargo 4.2.5; IBM Aspera Connect 4.2.5. Check the vendor advisory for mitigations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/248627
https://www.ibm.com/support/pages/node/6966588
https://exchange.xforce.ibmcloud.com/vulnerabilities/248627
https://www.ibm.com/support/pages/node/6966588

Get alerted when CVE-2023-27286 or the next vulnerability affects your stack