{"api_version":"1","generated_at":"2026-11-09T15:41:01+00:00","cve":"CVE-2026-120115","urls":{"html":"https://cve.report/CVE-2026-120115","api":"https://cve.report/api/cve/CVE-2026-120115.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120115","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120115"},"summary":{"title":"Multiple vulnerabilities in IBM Aspera Connect","description":"IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-11-08 18:17:00","updated_at":"2026-11-09 15:17:07"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295714","name":"https://www.ibm.com/support/pages/node/7295714","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120115","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120115","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Aspera Connect","version":"affected 1.6.1 4.2.19 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-120115","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T14:13:48.102541Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-09T14:13:57.443Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:aspera_connect:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_connect:4.2.19:*:*:*:*:*:*:*"],"product":"Aspera Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.

"}],"value":"IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-08T17:12:28.376Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295714"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

It is recommended to apply the fix as soon as possible, see links in the table below.

ProductFixing VRMPlatformLink to Fix
IBM Aspera Connect
4.2.20
LinuxLink
IBM Aspera Connect
4.2.20
Mac OSXLink
IBM Aspera Connect
4.2.20
WindowsLink

"}],"value":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes"}],"title":"Multiple vulnerabilities in IBM Aspera Connect"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-120115","datePublished":"2026-11-08T17:12:28.376Z","dateReserved":"2026-10-30T20:55:57.874Z","dateUpdated":"2026-11-09T14:13:57.443Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 18:17:00","lastModifiedDate":"2026-11-09 15:17:07","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-09T14:13:48.102541Z","id":"CVE-2026-120115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120115","Ordinal":"1","Title":"Multiple vulnerabilities in IBM Aspera Connect","CVE":"CVE-2026-120115","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120115","Ordinal":"1","NoteData":"IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.","Type":"Description","Title":"Multiple vulnerabilities in IBM Aspera Connect"}]}}}