CVE-2026-7876

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7274127	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:aspera_high-speed_transfer_server_for_cloud_pak_for_integration:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) IBM Aspera HSTS para CP4I 1.5.1 hasta 1.5.19 se ve afectado por una vulnerabilidad de omisión de autenticación. Un cliente de transferencia podría aprovechar esta vulnerabilidad para acceder a archivos en el almacenamiento local del servidor a los que no debería tener acceso, cuando no se aplican configuraciones de restricción específicas.

Information

Published : 2026-05-27 14:17

Updated : 2026-10-14 20:10

NVD link : CVE-2026-7876

Mitre link : CVE-2026-7876

CVE.ORG link : CVE-2026-7876

JSON object : View

Products Affected

ibm

aspera_high-speed_transfer_server_for_cloud_pak_for_integration

CWE

CWE-287

Improper Authentication

NVD-CWE-noinfo

{"id": "CVE-2026-7876", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7876", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T14:21:36.215142Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:aspera_hsts_for_cp4i:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_hsts_for_cp4i:1.5.19:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Aspera HSTS for CP4I", "versions": [{"status": "affected", "version": "1.5.1", "versionType": "semver", "lessThanOrEqual": "1.5.19"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-27T14:17:35.727", "references": [{"url": "https://www.ibm.com/support/pages/node/7274127", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19\u00a0is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place."}, {"lang": "es", "value": "IBM Aspera HSTS para CP4I 1.5.1 hasta 1.5.19 se ve afectado por una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. Un cliente de transferencia podr\u00eda aprovechar esta vulnerabilidad para acceder a archivos en el almacenamiento local del servidor a los que no deber\u00eda tener acceso, cuando no se aplican configuraciones de restricci\u00f3n espec\u00edficas."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_high-speed_transfer_server_for_cloud_pak_for_integration:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA132BA2-35FB-4791-9F4F-97090025751F", "versionEndExcluding": "1.5.20", "versionStartIncluding": "1.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}