Container Escape Vulnerability in IBM Aspera Enterprise WebApps

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 contain a security flaw that permits a local attacker with access to the application container to escape its security boundaries. The vulnerability arises because the container runtime environment permits unrestricted system calls (syscalls) that should be blocked by standard container hardening practices. By invoking these prohibited system calls, an attacker can interact directly with the underlying host kernel, potentially bypassing container isolation. This vulnerability poses a significant risk to host integrity in multi-tenant or shared-infrastructure environments where Aspera Enterprise WebApps is deployed.

Impact

Successful exploitation of this vulnerability allows a local attacker to escape the container environment, gaining unauthorized access to the host operating system. This could lead to full system compromise, data exfiltration from the host, or lateral movement within the network. The scope of impact is limited to organizations running the vulnerable 1.0.0 through 1.0.5 versions of the software in containerized environments.

Recommendation

• Update IBM Aspera Enterprise WebApps to the latest available version that patches CVE-2026-75777.
• Audit container security configurations to restrict syscalls via Seccomp profiles or AppArmor/SELinux policies.
• Apply the principle of least privilege by running containers with non-root users where possible, limiting the potential impact of an escape.