---
id: CVE-2026-7876
title: "IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19\_is affected by an authentication bypass vulnerability"
summary: "IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19\_is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not…"
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-287
vendor: ibm
product: aspera_high-speed_transfer_server_for_cloud_pak_for_integration
affected:
  - >-
    aspera_high-speed_transfer_server_for_cloud_pak_for_integration >= 1.5.1, <
    1.5.20
patched:
  - aspera_high-speed_transfer_server_for_cloud_pak_for_integration 1.5.20
published: '2026-05-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7876'
references:
  - url: 'https://www.ibm.com/support/pages/node/7274127'
    label: psirt@us.ibm.com
tags:
  - nvd
epss: 0.00502
epssPercentile: 0.41472
ingestedAt: '2026-10-14T20:53:12.323Z'
---

## Overview

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

## Affected

- `aspera_high-speed_transfer_server_for_cloud_pak_for_integration >= 1.5.1, < 1.5.20`

## Remediation

Upgrade past the affected range:

- `aspera_high-speed_transfer_server_for_cloud_pak_for_integration 1.5.20`