What is the CVSS score of CVE-2026-7876?

CVE-2026-7876 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM Aspera HSTS are affected by CVE-2026-7876?

IBM Aspera High-Speed Transfer Server in Cloud Pak for Integration versions 1.5.1-1.5.19 contains a critical authentication bypass vulnerability (CVSS 9.1) allowing remote attackers to access and…

How to fix or mitigate CVE-2026-7876?

24 hours: Inventory all IBM Aspera CP4I installations and identify instances running versions 1.5.1-1.5.19 to establish risk baseline. 7 days: Contact IBM Support to confirm patch timeline and request interim mitigation guidance; implement firewall-based network segmentation to restrict Aspera service access to authorized internal hosts only. 30 days: Develop and execute migration plan to unaffected versions or alternative file transfer solutions once vendor patch becomes available; deploy comprehensive audit logging for all Aspera transactions.

IBM Aspera HSTS CVE-2026-7876

EUVD-2026-32506 CRITICAL

Improper Authentication (CWE-287)

2026-05-27 psirt@us.ibm.com

GHSA-r5m9-vqmc-c77r

IBM Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 18:30 vuln.today

CVSS changed

May 28, 2026 - 16:22 NVD

9.1 (None) 9.1 (CRITICAL)

CVE Published

May 27, 2026 - 14:17 nvd

UNKNOWN (no severity yet)

DescriptionNVD

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19

AnalysisAI

Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 through 1.5.19 allows remote attackers to access and modify protected resources without valid credentials, scoring CVSS 9.1 critical. The flaw exposes confidential file transfer data and permits unauthorized modification of integrity-protected assets across all affected releases. No public exploit identified at time of analysis, and EPSS predicts only a 0.02% near-term exploitation probability despite the high severity rating.

Technical ContextAI

IBM Aspera HSTS is a FASP-protocol-based high-speed transfer server bundled into the IBM Cloud Pak for Integration (CP4I) platform, used for moving large datasets across enterprise and hybrid-cloud boundaries. The vulnerability is classified as CWE-287 (Improper Authentication), meaning the server fails to correctly verify the identity of a client before granting access to functionality or data - typical root causes in this class include missing credential checks on a protected endpoint, mishandled token validation, or trust placed in attacker-controlled identity claims. Because Aspera HSTS commonly fronts file-transfer APIs and management endpoints, an authentication weakness directly undermines the trust boundary the product is meant to enforce. No CPE strings were provided in the input, so exact configuration scope (e.g., specific service component or auth mechanism) must be confirmed from the IBM advisory.

RemediationAI

Patch availability is not explicitly enumerated in the provided intelligence, so treat this as: patch available per vendor advisory - consult https://www.ibm.com/support/pages/node/7274127 for the fixed CP4I/Aspera HSTS release and apply the vendor-recommended upgrade above 1.5.19 once confirmed. Until the patched version is deployed, restrict network reachability to Aspera HSTS management and transfer endpoints by placing them behind a VPN or zero-trust gateway, enforce IP allowlisting on the Cloud Pak for Integration ingress, and require an authenticating reverse proxy (e.g., mTLS or SSO at the edge) in front of the service so that the vulnerable code path is not exposed to unauthenticated callers - note that proxy-fronting may break Aspera FASP UDP transfers, so test transfer throughput before enforcing. Increase audit logging on Aspera authentication and file-transfer events to detect any anomalous access during the exposure window.