Denial of Service Vulnerability in IBM Aspera Enterprise WebApps

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 contain a critical vulnerability identified as CVE-2026-75095. This flaw stems from improper management of system resources, which can be triggered by a remote attacker. Successful exploitation of this vulnerability leads to an uncontrolled resource consumption condition, effectively resulting in a denial of service (DoS) for the affected application. Because the application processes requests from remote users, an attacker can leverage this flaw to intentionally exhaust server resources like CPU or memory, rendering the service unresponsive to legitimate traffic. Given that this is a publicly disclosed vulnerability affecting server-side enterprise software, organizations deploying these versions should prioritize identifying affected instances and scheduling the necessary vendor patches to prevent potential service disruption.

Impact

The vulnerability poses a significant risk to organizations relying on IBM Aspera Enterprise WebApps for critical data transfer operations. A successful denial of service attack can lead to prolonged downtime, preventing business units from accessing or transferring files, and requiring manual intervention to restore service. The impact is primarily on operational availability rather than data integrity or confidentiality.

Recommendation

Prioritize the identification of all IBM Aspera Enterprise WebApps instances within the environment. Consult official IBM security advisories for the availability of security patches and apply updates to versions beyond 1.0.6 immediately. In the interim, implement rate limiting on network edge devices or web application firewalls to mitigate the impact of high-volume resource consumption requests targeting the application.