Medium severity · published Mar 10, 2026
CVE-2025-36227
Multiple vulnerabilities in IBM Aspera Faspex
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Aspera Faspex 5 · IBM
5.0.0 through 5.0.14.3 · source: vendor
AF
Aspera Faspex · Ibm
5.0.0 before 5.0.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-36227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-36227
Vendor Advisory
https://www.ibm.com/support/pages/node/7262816
More from Aspera Faspex 5
8.2
CVE-2026-14996
Multiple vulnerabilities in IBM Aspera Faspex
7.2
CVE-2026-14958
OS command injection in IBM Aspera Faspex
7.2
CVE-2026-14959
OS Command Injection in IBM Aspera Faspex
5.4
CVE-2025-36226
Multiple vulnerabilities in IBM Aspera Faspex
5.4
CVE-2025-36230
XSS in IBM Aspera Faspex