The Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited critical IBM vulnerability to its known exploited vulnerabilities (KEV) catalog. The flaw, which was patched on January 18, 2023, is tracked as CVE-2022-47986 and affects the IBM Aspera Faspex file transfer tool. Aspera is extremely popular with large enterprises and organizations for transferring large datasets, like “genomics and biomedical research, media production, military signals intelligence, or financial services.” In 2014, Aspera won an Emmy award for its work in the media production industry, enabling a boost in industry-wide workflows due to its ability to quickly transfer large media files. This vulnerability exploits an obsolete API call only present in Aspera Faspex versions 4.4.1 and earlier. A threat actor could make a maliciously crafted API call to a vulnerable instance of Faspex, which allows for remote code execution (RCE). This flaw received a CVSS score of 9.8/10 due to its active exploitation, as well as the low complexity of the exploit, coupled with the fact that attackers do not have to authenticate themselves prior to gaining initial access. At this time, Shodan searches indicate that more than 100 IBM Aspera Faspex servers are internet-exposed and may be vulnerable to exploitation. This vulnerability’s presence on the CISA KEV mandates that all federal civilian executive branch (FCEB) agencies patch the flaw no later than March 14, 2023, or face financial penalties. This is not the first file transfer tool exploited to wreak havoc against major corporations. Just last week, the Russian-speaking ransomware-as-a-service (RaaS) group Clop claimed responsibility for exploiting the GoAnywhere MFT file-transfer tool, impacting one of the largest healthcare providers in the U.S., affecting more than 1 million patients and employees. CTIX analysts recommend that all organizations who depend on the IBM Aspera Faspex tool, immediately patch this vulnerability by updating their software to the most recent secure version.