CVE-2023-37407 is a high severity (CVSS 8.8) command injection in IBM Aspera Orchestrator 4.0.1 that lets an authenticated remote user run commands on the system. IBM's bulletin lists a fix for 4.0.1 delivered as PL1 and PL2 for Linux. Apply the fix and review who has accounts.
What's affected
IBM's bulletin lists one affected version, IBM Aspera Orchestrator 4.0.1. The remediation is a fix for that version on Linux, delivered as PL1 and PL2, with the download linked in the bulletin. IBM says there are no workarounds or mitigations.
The weakness is CWE-78 (OS command injection). NVD and IBM agree on the score: 8.8, high, with network access, low complexity, low privileges and no user interaction. IBM's bulletin uses CVSS 3.0 and NVD uses 3.1, but the vector is the same. The record describes the attack as sending a specially crafted request, and the advisories give no more than that, so this post does not either.
How to check if you're exposed
- Sign in to Orchestrator as an administrator and confirm the product version. Only 4.0.1 is named as affected.
- Check whether the PL1 or PL2 fix is applied, using the patch level information in the product and the bulletin's instructions.
- List the accounts that can sign in. The attacker must be authenticated, so a long list of users, shared accounts or weak passwords raises the risk.
- Check whether Orchestrator is reachable from the internet or from broad internal networks. The vector is network based.
What to do now
- Apply the IBM fix for 4.0.1 from the link in the bulletin, as soon as your change window allows.
- Restrict access to the Orchestrator interface to the networks and people who need it.
- Review accounts, remove unused ones, and enforce strong credentials and multi factor sign in where the product supports it.
- Look at Orchestrator host logs for unexpected commands or requests from accounts you do not recognise. The bulletin does not describe indicators, so this is general practice.
Why it matters
Command injection happens when input from a user reaches a system shell or command without being cleaned. The product then runs the attacker's text as if it were its own command, with the rights of the Orchestrator service account. Because a workflow tool usually connects to other systems, that account can hold a lot of access.
The requirement for authentication helps, but not as much as it sounds. Credentials get phished, reused and shared, and a low privilege account is enough here. The record does not mark the CVE as known exploited, and the IBM bulletin does not report exploitation. Matching your server inventory against advisories turns this into a quick lookup, as the demo below shows. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need credentials?
Yes. The record describes a remote authenticated attacker, with low privileges and no user interaction. That is still enough for a full compromise of the service according to the score.
Sources
Last reviewed: 19 October 2026.
