#ibm

Analysis · May 20, 2026 · Colten Anderson

Insecure deserialization isn't a Java problem. Ask Ruby's YAML.load.

CVE-2022-47986 is a pre-auth RCE in IBM Aspera Faspex from a single call to YAML.load on data an unauthenticated user controls. It's the Ruby version of the deserialization footgun, and ransomware crews used it to move onto Linux.