⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 9.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2022-47986: IBM Aspera Faspex YAML Deserialization RCE

*By Sai Kiran Pandrala*

⚡ At a glance
SeverityCVSS 9.8, Critical
Actively exploited?Yes, listed in CISA KEV. IceFire ransomware used it against Linux deployments.
AffectedIBM Aspera Faspex 4.4.2 Patch Level 1 and earlier
Fixed inAspera Faspex 4.4.2 Patch Level 2, or 5.0.0+ (Faspex 5 is the supported next-gen line)
Type (CWE)YAML Deserialization (related to CWE-502)

⚠️ Faspex 4 is end-of-life as of mid-2024. If you're still running it, the supported path is to migrate to Faspex 5, or patch to 4.4.2 PL2 as bridge while you plan the migration.

What is CVE-2022-47986?

IBM Aspera Faspex deserializes YAML input on certain API endpoints without proper validation. An unauthenticated remote attacker can submit a crafted YAML payload that causes Faspex to instantiate attacker-controlled Ruby objects, leading to remote code execution as the Faspex service account.

Aspera Faspex is enterprise file-transfer software for large data movement (broadcasting, life sciences, financial data feeds). Compromise typically exposes transfer credentials and any in-flight transfer content. IceFire ransomware affiliates used CVE-2022-47986 specifically to land on Linux-based Faspex deployments in early 2023.

Am I affected?

You are affected if you run IBM Aspera Faspex 4.4.2 Patch Level 1 or earlier. Faspex 4 versions older than 4.4.x have been unsupported for years, same conclusion, same migration urgency.

Check your Faspex version: log into the Faspex admin UI → version shown in the page footer, or check the install path on the Faspex host.

How to fix CVE-2022-47986

If you're on Faspex 4.x (short-term)

  1. Open the IBM security bulletin linked below and download Aspera Faspex 4.4.2 Patch Level 2.
  2. Back up the Faspex database and /opt/aspera/faspex/ configuration directory.
  3. Stop the Faspex service:

   sudo systemctl stop aspera-faspex
  1. Apply the patch following IBM's documented upgrade procedure (typically a .bin installer that detects the existing install).
  2. Restart Faspex and verify the version.

Long-term, migrate to Faspex 5

Faspex 4 reached end of support. Faspex 5 is the current supported product. The migration tooling is documented in IBM's Faspex 5 deployment guide. Plan this migration if you haven't already, the Faspex 4 train will not receive future security updates beyond critical EOL fixes.

If you can't patch immediately

How to verify the fix worked

  1. Faspex admin → version shows 4.4.2 PL2 or 5.x.
  2. Run a vulnerability scan against the Faspex URL. CVE-2022-47986 detection should clear.
  3. IoC hunt for IceFire: review the Faspex host file system for unfamiliar Ruby scripts or shell binaries dropped in early 2023. Check for the IceFire ransomware note pattern in user directories.

Frequently asked questions

Is CVE-2022-47986 actively exploited?

Yes. CVE-2022-47986 is on the CISA Known Exploited Vulnerabilities catalog, so federal civilian agencies are required to patch on the published deadline. Most enterprises treat the same date as the practical floor.

What is the CVSS severity of CVE-2022-47986?

Critical. See the advisory for the full CVSS vector.

Where can I read the official advisory?

See https://www.ibm.com/support/pages/security-bulletin-ibm-aspera-faspex-affected-vulnerability-cve-2022-47986

Does the patch require a reboot?

It depends on the deployment. Service-only updates usually need a service restart; OS-level fixes require a full reboot. Check the vendor release notes for the exact post-upgrade steps.

References

*This guide was assembled from the IBM security bulletin, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against IBM's bulletin before applying changes in production.*

Other vulnerabilities in the same area that are worth patching alongside this one: