{"affected":[{"product":"Aspera Connect","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"cveId":"CVE-2026-120113","cwes":["CWE-306"],"description":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794157921863,"publishedAt":1794157921863,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295714"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7295714"}],"revision":"91c35193bfb4af9b212632dfc727f136edc8d6578c7aa64037933f4dfe4f8393","sources":[{"modifiedAt":1794157921863,"name":"CNA: ibm","retrievedAt":1794161316605,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120113"}],"ssvc":null,"status":"published","title":"Multiple vulnerabilities in IBM Aspera Connect","updatedAt":1794161316605}