Critical Remote Code Execution in IBM Aspera Faspex (CVE‑2022‑47986)
What It Is — IBM Aspera Faspex contains a YAML deserialization flaw that allows an unauthenticated remote attacker to execute arbitrary code on the host system.
Exploitability — Publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code is available and the vulnerability is actively exploited in the wild. CVSS v3.1 base score: 9.8 (Critical).
Affected Products — IBM Aspera Faspex 4.2.0 and earlier releases (on‑premises and cloud‑hosted deployments).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping: a single code‑execution flaw can invalidate assumptions about system integrity across multiple frameworks.
- Highlights the importance of defensible audit evidence that a vulnerable component has been patched and that remediation steps are documented.
- Signals to enterprise buyers that continuous monitoring of third‑party software versions is a core trust signal, not a one‑time checklist item.
Recommended Actions
- Verify the exact version of Aspera Faspex in use; upgrade to the IBM‑released patch (version 4.2.1 or later).
- Record the upgrade in your control evidence repository and map the remediation to the “Secure Configuration Management” control area.
- Enable automated inventory scanning to flag future unpatched versions of third‑party software.
- Review logging and alerting for any anomalous process launches that could indicate exploitation attempts.
Source: CISA KEV – CVE‑2022‑47986