CVE-2026-7876
Critical
Description
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Ibm Aspera High-speed Transfer Server For Cloud Pak For Integration
PublishedMay 27, 2026
First seenMay 27, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- ibm aspera_high-speed_transfer_server_for_cloud_pak_for_integration1.5.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm aspera_high-speed_transfer_server_for_cloud_pak_for_integration | 1.5.1 ≤ v < 1.5.20 | 1.5.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.