CVE-2026-75621

Received Received - Intake

Excessive Permissions in IBM Aspera Enterprise WebApps

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-75621

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Aspera	Enterprise WebApps 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-250	The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 allows a local attacker to access sensitive information because the service account has excessive permissions.

Impact Analysis

A local attacker could exploit this to steal sensitive data due to improper permissions on the service account, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR and HIPAA requirements for protecting sensitive information.

Mitigation Strategies

Review and restrict permissions for the service account associated with IBM Aspera Enterprise WebApps to the minimum required level. Ensure the account does not have excessive privileges that could expose sensitive information.

Hi! I’m here to help you understand CVE-2026-75621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70