CVE-2026-75782

Received Received - Intake

Privilege Escalation in IBM Aspera Enterprise WebApps

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-75782

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Aspera	Enterprise WebApps 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

This vulnerability is a local privilege escalation issue in IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6. It occurs because the application incorrectly configures the PATH environment variable, allowing a local attacker to manipulate it and gain higher privileges than intended.

Impact Analysis

If exploited, this vulnerability could let an attacker with local access take control of the system, steal sensitive data, install malware, or disrupt services. The high CVSS score (7.8) indicates significant risk as it requires low attack complexity and no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Review and correct the PATH environment variable configuration to ensure it does not include untrusted directories. Apply the latest patches or updates from IBM for Aspera Enterprise WebApps versions 1.0.0 through 1.0.6.

Hi! I’m here to help you understand CVE-2026-75782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70