CVE-2022-47986

IBM Aspera Faspex code execution

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Affected

IBM · Aspera Faspex

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99.97% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2023-02-21, used in ransomware campaigns

Nuclei

critical · CWE-502

Published

2023-02-17

Updated

2025-10-21

Proof-of-concept exploits (2)

• mauricelambert/CVE-2022-479861★ · 2023-03-09
• ohnonoyesyes/CVE-2022-479866★ · 2023-02-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47986.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51316

Exploit collections (1)

• CVE-2022-47986.yamlzan8in/afrog

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/243512
• https://www.ibm.com/support/pages/node/6952319
• http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization…

References

• CVE Record
• NVD entry

Related

• CVE-2021-21985
• CVE-2021-31166
• CVE-2021-41773
• CVE-2021-42013
• CVE-2021-43798
• CVE-2022-21907