CVE-2022-47986

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

100.0% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

4 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2023-02-21remediate by 2023-03-14

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

IBM Aspera Faspex Code Execution Vulnerability

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@us.ibm.com USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502US

exploits (3)

Public proof-of-concept and weaponised exploit code.

EDB-51316IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)PoC · exploit_db
mauricelambert/CVE-2022-47986CVE-2022-47986: Python, Ruby, NMAP and Metasploit modules to exploit the vulnerability.PoC · poc_in_github
ohnonoyesyes/CVE-2022-47986Aspera Faspex Pre Auth RCEPoC · poc_in_github

affected products (4)

Products and version ranges known to be affected.

IBM Aspera Faspex≤ 4.4.2 Patch Level 1 and earlierenisa_euvdEU
IBM Corp. IBM Aspera Faspex≤ 4.4.2 PL 1fstec_bduRU
ibm aspera faspex≤ 4.4.1nvdUScpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*
ibm aspera faspex= 4.4.2nvdUScpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2023-02-17modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan