CVE-2026-7876CWE-287

CVE-2026-7876

Critical · published May 27, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-05-27T18:17Z
Affected products (1)
ProductVersionsFixed in
ibm/aspera_high-speed_transfer_server_for_cloud_pak_for_integration≥ 1.5.1, < 1.5.201.5.20
References (1)
https://www.ibm.com/support/pages/node/7274127 · [email protected]
EPSS history
Timeline
  • 27 MAY 13:56Z
    Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration
    cvelistv5