CVE-2026-14996 describes an insufficient session expiration vulnerability in IBM Aspera Faspex 5, specifically affecting versions 5.0.0 through 5.0.15.4. This vulnerability relates to improper session management where sessions may remain active longer than intended, potentially allowing unauthorized users to access resources. The CVSS v3.1 score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact. The vulnerability has been addressed in versions after 5.0.15.4, although no explicit patch link or vendor advisory is provided in the input data.

The vulnerability allows an attacker to potentially gain unauthorized access by exploiting sessions that do not expire properly, leading to a high confidentiality impact. Integrity impact is low and availability is not affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the issue is addressed in versions after 5.0.15.4, so upgrading to a version later than 5.0.15.4 is recommended once official patches or updates are available from IBM. Monitor IBM's official security advisories for updates.