by Kastro
Paper/Archive/CVE-2026-7876

CVE-2026-7876

IBM Aspera HSTS for CP4I — Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 24.1.241 × 204.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

Affected

ProductAffectedFixed inSource
Aspera HSTS for CP4I1.5.1 – 1.5.19–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7274127