CVE-2026-120113 PUBLISHED

Multiple vulnerabilities in IBM Aspera Connect

Assigner: ibm
Reserved: 30.10.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 6.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Aspera Connect
Versions	affected from 1.6.1 to 4.2.19 (incl.)

Solutions

It is recommended to apply the fix as soon as possible, see links in the table below.

ProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20

Linux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20

Mac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20

Windows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes

References

https://www.ibm.com/support/pages/node/7295714

Problem Types

CWE-306 Missing Authentication for Critical Functionality CWE