CVE-2026-120115 · Other
NO FIX YET
IBM Aspera Connect, a browser helper used for file transfers, does not consistently check which website is calling its local REST API for versions 1.6.1 through 4.2.19. A malicious website a user visits can delete or inspect account configurations.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams whose staff use IBM Aspera Connect on their machines to transfer files are exposed when a user browses a malicious site while Connect is running. The sources do not say which Connect builds or configurations are most exposed, and the sources do not name a fixed version. Machines without Aspera Connect installed can skip it.
Not affected if not-installed
Who cares ibm-aspera-connect, macos, windows
1.6.1 through 4.2.19No fix yet, per the sources.
IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.