PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14973 IBM CVE debrief

IBM Aspera Desktop App versions 1.0.5 through 1.0.19 are vulnerable to a critical issue allowing files to be written outside of the user's selected download destination. This vulnerability, tracked as CVE-2026-14973, has a CVSS score of 9.3 and is classified as CRITICAL. The issue arises from improper handling of file downloads, potentially leading to system compromise. Organizations using affected versions should prioritize patching. Security teams and IT administrators responsible for patch management and vulnerability remediation should take immediate action to prevent potential file writing outside of the selected download destination. Limited details are provided on exploitation or affected scope, emphasizing the need for defenders to verify system logs for suspicious file writes and review user download destinations. The CVE record was published on 2026-07-28T21:17:26.570Z and has not been modified since then.

Vendor
IBM
Product
Aspera Desktop App
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-28
Original CVE updated
2026-08-13
Advisory published
2026-07-28
Advisory updated
2026-08-13

Who should care

Organizations using IBM Aspera Desktop App versions 1.0.5 through 1.0.19, security teams, and IT administrators responsible for patch management and vulnerability remediation should prioritize patching to prevent potential file writing outside of the selected download destination. Additionally, operators and platform administrators may need to review affected deployments and implement compensating controls.

Technical summary

IBM Aspera Desktop App versions 1.0.5 through 1.0.19 are vulnerable to a file writing issue outside of the user's selected download destination. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. This issue allows attackers to write files to arbitrary locations, potentially leading to system compromise.

Defensive priority

Organizations using IBM Aspera Desktop App versions 1.0.5 through 1.0.19 should prioritize patching to prevent potential file writing outside of the selected download destination.

Recommended defensive actions

  • Inventory and verify IBM Aspera Desktop App version
  • Apply patches or updates provided by IBM
  • Monitor for suspicious file writes outside download destinations
  • Implement compensating controls to restrict file writes
  • Exception tracking for potential false positives

Evidence notes

The CVE record indicates IBM Aspera Desktop App versions 1.0.5 through 1.0.19 are vulnerable, allowing files to be written outside of the user's selected download destination. Limited details are provided on exploitation or affected scope. Defenders should verify system logs for suspicious file writes and review user download destinations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14973 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14973

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14973 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14973

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.