IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.

CVE-2026-14959 affects IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4. The vulnerability allows a remote authenticated attacker to execute arbitrary code on the affected system via shell command injection. The flaw requires authentication, meaning an attacker must have valid credentials to exploit it. IBM has issued an advisory with remediation guidance. The severity is rated high due to the potential for full system compromise through remote code execution. Organizations using affected versions of IBM Aspera Faspex 5 should apply patches immediately.