CVE-2026-9035CWE-22

Multiple vulnerabilities in Aspera applications.

Medium · published May 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00453 · 38.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-27T13:21Z
EPSS history
Timeline
  • 27 MAY 13:21Z
    Multiple vulnerabilities in Aspera applications.
    cvelistv5