# CVE-2026-75076: IBM Aspera Enterprise WebApps information disclosure via source maps

Source: https://junglewise.ai/threats/cve-2026-75076-ibm-aspera-enterprise-webapps-1-0-0-through-1-0-6-could-allow-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-75076 · Severity: medium · CVSS 4.3 · Published 2026-10-12

IBM Aspera Enterprise WebApps is a file transfer and management platform used by enterprises. A vulnerability allows remote attackers to expose JavaScript source map files, which can leak sensitive information such as application logic, API endpoints, and internal variable names that are normally hidden from browser inspection.

Technologies: [IBM Aspera Enterprise WebApps](https://junglewise.ai/threats/technologies/aspera-enterprise-webapps). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-75076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75076 being exploited in the wild.

**How severe is CVE-2026-75076?** Medium severity, with a CVSS score of 4.3, published 12 October 2026.

**Which products and versions are affected?** IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6.

**Is there a fix for CVE-2026-75076?** Yes: fixed in IBM Aspera Enterprise WebApps 1.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75076 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75076?** Check whether you run IBM Aspera Enterprise WebApps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IBM Aspera Enterprise WebApps 1.0.7

## Technical details

The vulnerability is an exposure of sensitive information (CWE-200) due to publicly accessible JavaScript source map files. It requires network access with no authentication or user interaction needed, and affects versions 1.0.0 through 1.0.6. A remote attacker can retrieve source maps to obtain source code-level details that may reveal security-relevant implementation details or credentials.

## Affected products

- IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6

## Timeline

- 2026-10-12: disclosed
- 2026-10-08: patched: Fix released in version 1.0.7

## References

- [https://www.ibm.com/support/pages/node/7291755](https://www.ibm.com/support/pages/node/7291755)

## Related threats

- [IBM Aspera Enterprise WebApps cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-92832-ibm-aspera-enterprise-webapps-1-0-0-through-1-0-6-could-allow-a)
- [IBM Aspera Enterprise WebApps privilege escalation via PATH environment variable](https://junglewise.ai/threats/cve-2026-75782-ibm-aspera-enterprise-webapps-1-0-0-through-1-0-6-could-allow-a)
- [IBM Aspera Enterprise WebApps privilege escalation in service account](https://junglewise.ai/threats/cve-2026-75621-ibm-aspera-enterprise-webapps-1-0-0-through-1-0-6-could-allow-a)
- [IBM Aspera Enterprise WebApps denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-75095-ibm-aspera-enterprise-webapps-1-0-0-through-1-0-6-could-allow-a)
- [IBM Aspera Enterprise WebApps container escape via unrestricted system calls](https://junglewise.ai/threats/cve-2026-75777-ibm-aspera-enterprise-webapps-container-escape-via-unrestricted)