PatchTheCVEaspera orchestrator vulnerabilities and fixes
Recent CVEs affecting aspera orchestrator, with upgrade or downgrade steps. 5 tracked.
Also searched as: asperaorchestrator.
aspera orchestrator has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-10. Highest priority: CVE-2025-13219 (score 33/100).
- CVE-2025-13219 MEDIUM 5.9 UPGRADE IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters
- CVE-2025-13213 MEDIUM 5.4 UPGRADE IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validat
- CVE-2023-38001 MEDIUM 6.5 DOWNGRADE IBM Aspera Orchestrator 4.0.1 is vulnerable to cross-site request forgery which could allow an attacker to exe
- CVE-2023-26289 MEDIUM 5.4 DOWNGRADE IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input b
- CVE-2023-26288 MEDIUM 5.5 DOWNGRADE IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authent
FAQ
How do I fix aspera orchestrator vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is aspera orchestrator being exploited right now?
None of the tracked aspera orchestrator CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which aspera orchestrator CVE should I patch first?
CVE-2025-13219 currently ranks highest (33/100): IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters.