CVE-2026-7876
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability.
Published May 27, 2026 · updated Oct 14, 2026 · ibm aspera high-speed transfer server for cloud pak for integration
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 27, 2026 · NIST NVD
Detected
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
Oct 14, 2026 · NIST NVD
Updated
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
Affected
- cpe ibm/aspera high-speed transfer server for cloud pak for integrationversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-7876
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-7876
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2026-7876
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction
nvd.nist.gov