CVE-2026-120115 PUBLISHED

Multiple vulnerabilities in IBM Aspera Connect

Assigner: ibm
Reserved: 30.10.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS Score: 6.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	IBM
Product	Aspera Connect
Versions	affected from 1.6.1 to 4.2.19 (incl.)

Solutions

It is recommended to apply the fix as soon as possible, see links in the table below.

ProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20

Linux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20

Mac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20

Windows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes

References

https://www.ibm.com/support/pages/node/7295714

Problem Types

CWE-862 Missing Authorization CWE