PT-2026-43986 · Ibm · Aspera Hsts For Cp4I+1

Yannik Marchand · CVE-2026-7876 · Published 2026-05-27 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Aspera HSTS for CP4I versions 1.5.1 through 1.5.19

Description An authentication bypass allows a transfer client to access files in the server's local storage that should be restricted, provided that specific restriction settings are not configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-7876

Affected Products

Aspera Hsts For Cp4I

Aspera High-Speed Transfer Server For Cloud Pak For Integration

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7876 · Security Note
• https://ibm.com/support/pages/node/7274127 · Patch, Vendor Advisory
• https://t.me/cveNotify/167048 · Telegram Post