CVE-2022-47986
IBM Aspera Faspex Code Execution Vulnerability
Description
CVE-2022-47986 is a critical YAML deserialization vulnerability in IBM Aspera Faspex version 4.4.2 Patch Level 1 and earlier that allows a remote, unauthenticated attacker to execute arbitrary code on the target system. The flaw exists in an obsolete API call that improperly processes YAML input, enabling an attacker to craft a malicious request that triggers code execution. With a CVSS score of 9.8 and an EPSS score of 94.3%, CVE-2022-47986 represents one of the most actively exploited vulnerabilities in the IBM Aspera Faspex product line. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog and confirmed its use in ransomware campaigns, making immediate patching essential for any organization running affected versions of IBM Aspera Faspex.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ibm | aspera faspex | <= 4.4.1; 4.4.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html(Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/243512(VDB Entry, Vendor Advisory)
- https://www.ibm.com/support/pages/node/6952319(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47986(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
In the context of IBM Aspera Faspex, CWE-502 manifests through unsafe YAML deserialization within an obsolete API endpoint. The application fails to validate or sanitize incoming YAML data before processing it, allowing an attacker to inject malicious objects that are instantiated during deserialization, ultimately leading to arbitrary code execution on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2022-47986 carries a CVSS score of 9.8 (Critical), reflecting the maximum impact across all three security dimensions. The vulnerability is remotely exploitable over the network without requiring physical access to the target system. Attack complexity is low, meaning no special conditions or preparation are needed to exploit the flaw. Critically, no authentication or user interaction is required, allowing any remote attacker to target vulnerable IBM Aspera Faspex instances directly. Confidentiality, integrity, and availability are all rated as High impact — a successful exploit grants the attacker full control over the affected system, enabling data theft, system modification, and service disruption. The EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation activity, and CISA has confirmed this vulnerability is actively used in ransomware campaigns, significantly elevating the urgency for remediation.
Exploit Maturity
CVE-2022-47986 has a mature exploit landscape with confirmed active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog and confirmed its association with ransomware operations. A public exploit for IBM Aspera Faspex YAML deserialization is available via Packet Storm Security, providing detailed technical information for potential attackers. The EPSS score of 94.3% indicates near-certain exploitation activity, placing this vulnerability in the 99.95th percentile of all scored CVEs. Organizations running unpatched IBM Aspera Faspex instances should treat this as an active, ongoing threat requiring immediate action.
Remediation
- Apply the IBM patch immediately. Upgrade IBM Aspera Faspex to version 4.4.2 Patch Level 2 or later, which removes the vulnerable obsolete API call. IBM has released a vendor advisory with patch details at their support page. CISA requires remediation by 2023-03-14.
- Restrict network access to the Faspex server. Place the IBM Aspera Faspex instance behind a firewall or reverse proxy and limit inbound access to only trusted IP ranges. Block public internet access to the Faspex web interface until patching is complete.
- Disable or block the obsolete API endpoint. If immediate patching is not feasible, use a web application firewall (WAF) rule to block requests to the vulnerable API endpoint that processes YAML data, preventing exploitation attempts.
- Review system logs and check for indicators of compromise. Examine web server access logs for unusual API calls, unexpected process spawns, or signs of YAML deserialization payloads. Check for unauthorized accounts, scheduled tasks, or persistence mechanisms that may indicate prior exploitation.
- Implement deserialization hardening practices. As a long-term measure, ensure that any application processing serialized data validates and sanitizes input before deserialization. Consider deploying runtime application self-protection (RASP) or intrusion detection systems that can detect deserialization attacks.
Technical Details
CVE-2022-47986 exploits a YAML deserialization flaw in IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier, classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability resides in an obsolete API call that accepts YAML-formatted input and passes it to a YAML parser without proper validation or type restrictions. An attacker can craft a specially constructed YAML payload containing malicious object references that, when deserialized by the server, instantiate arbitrary classes and execute code in the context of the Faspex application. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is trivially achievable over the network with no prerequisites — no authentication, no user interaction, and no special configuration required. Because the deserialization occurs server-side with the privileges of the Faspex application process, successful exploitation yields complete control over the affected system, including the ability to read sensitive data, modify files, and disrupt service availability.
Frequently Asked Questions
Is CVE-2022-47986 being actively exploited?
Yes, CVE-2022-47986 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 14, 2023. This vulnerability is also confirmed to be used in ransomware campaigns, making it a high-priority threat for all organizations running IBM Aspera Faspex.
What products are affected by CVE-2022-47986?
CVE-2022-47986 affects IBM Aspera Faspex version 4.4.2 Patch Level 1 and earlier. All prior versions of the Faspex file transfer solution are vulnerable. The issue was resolved in IBM Aspera Faspex 4.4.2 Patch Level 2.
How do I fix CVE-2022-47986?
The primary remediation is to upgrade IBM Aspera Faspex to version 4.4.2 Patch Level 2 or later, which removes the vulnerable obsolete API call entirely. Until patching is possible, restrict network access to the Faspex server and use WAF rules to block suspicious YAML payloads targeting the affected API endpoint. See the Remediation section for detailed steps.
How severe is CVE-2022-47986?
CVE-2022-47986 is rated Critical with a CVSS score of 9.8 out of 10.0. It requires no authentication or user interaction, is remotely exploitable with low complexity, and results in full compromise of confidentiality, integrity, and availability. With an EPSS score of 94.3% (99.95th percentile), this vulnerability has one of the highest exploitation probabilities among all tracked CVEs.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.