EUVD-2026-32506
GHSA-r5m9-vqmc-c77r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed CP4I Aspera HSTS endpoint
-
DeliverySend crafted request bypassing authentication
-
ExploitGain unauthorized session or access token
-
ExecutionRead protected transfer data
-
PersistModify integrity-protected resources
-
ImpactExfiltrate sensitive files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network reachability to an IBM Aspera HSTS instance deployed under IBM Cloud Pak for Integration at version 1.5.1 through 1.5.19; no valid user credentials, no user interaction, and no elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to deployments where the CP4I-bundled Aspera HSTS service is exposed to the attacker's network position - instances isolated behind internal segmentation, VPN, or an authenticating reverse proxy reduce reachability, and sites running CP4I builds outside the 1.5.1-1.5.19 band are not in scope. Availability is unaffected (A:N), so the condition for impact is access to confidentiality- or integrity-protected resources rather than service disruption. |
| Impact | Risk signals are mixed and warrant careful weighing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with high impact on confidentiality and integrity but no availability impact, producing a 9.1 critical score; SSVC corroborates this with Automatable=yes and Technical Impact=total, indicating the flaw is scriptable and grants full control of the protected scope when triggered. However, SSVC Exploitation=none, the absence from CISA KEV, and an EPSS score of 0.02% (4th percentile) all indicate that no public exploitation or weaponization has been observed, and predicted near-term exploitation is very low. The most likely explanation is that this is a freshly disclosed IBM-reported issue without public technical detail or POC - defenders should treat it as a high-priority patch for any CP4I deployment exposing Aspera HSTS, but mass-scanning exploitation is not currently expected. No conflicting data was identified in the inputs. |
| Exploit ScenarioDerived | An attacker on a network with reachability to a CP4I cluster exposing Aspera HSTS sends a crafted request to the vulnerable endpoint that bypasses the authentication check, then enumerates and downloads files staged for transfer or modifies transfer configurations to redirect or tamper with sensitive data flowing through the integration platform. Because SSVC rates the flaw as Automatable with total technical impact, a single working request could be wrapped in a script and pointed at any exposed instance. No public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 through 1.5.19 allows remote attackers to access and modify protected resources without valid credentials, scoring CVSS 9.1 critical. The flaw exposes confidential file transfer data and permits unauthorized modification of integrity-protected assets across all affected releases. No public exploit identified at time of analysis, and EPSS predicts only a 0.02% near-term exploitation probability despite the high severity rating.
RemediationAI
Patch availability is not explicitly enumerated in the provided intelligence, so treat this as: patch available per vendor advisory - consult https://www.ibm.com/support/pages/node/7274127 for the fixed CP4I/Aspera HSTS release and apply the vendor-recommended upgrade above 1.5.19 once confirmed. Until the patched version is deployed, restrict network reachability to Aspera HSTS management and transfer endpoints by placing them behind a VPN or zero-trust gateway, enforce IP allowlisting on the Cloud Pak for Integration ingress, and require an authenticating reverse proxy (e.g., mTLS or SSO at the edge) in front of the service so that the vulnerable code path is not exposed to unauthenticated callers - note that proxy-fronting may break Aspera FASP UDP transfers, so test transfer throughput before enforcing. Increase audit logging on Aspera authentication and file-transfer events to detect any anomalous access during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Aspera HSTS is a FASP-protocol-based high-speed transfer server bundled into the IBM Cloud Pak for Integration (CP4I) platform, used for moving large datasets across enterprise and hybrid-cloud boundaries. The vulnerability is classified as CWE-287 (Improper Authentication), meaning the server fails to correctly verify the identity of a client before granting access to functionality or data - typical root causes in this class include missing credential checks on a protected endpoint, mishandled token validation, or trust placed in attacker-controlled identity claims. Because Aspera HSTS commonly fronts file-transfer APIs and management endpoints, an authentication weakness directly undermines the trust boundary the product is meant to enforce. No CPE strings were provided in the input, so exact configuration scope (e.g., specific service component or auth mechanism) must be confirmed from the IBM advisory.
Know when Aspera High Speed Transfer Server For Cloud Pak For Integration gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19
Executive ViewAI
IBM Aspera High-Speed Transfer Server in Cloud Pak for Integration versions 1.5.1-1.5.19 contains a critical authentication bypass vulnerability (CVSS 9.1) allowing remote attackers to access and modify protected file transfer data without valid credentials. Organizations running these versions face immediate risk of unauthorized data access, modification, and potential compliance violations across all affected deployments. The absence of available patches creates an urgent operational and security exposure.
No vendor-released patch identified at time of analysis. Implement network-level access controls to restrict Aspera service connectivity to authorized internal networks only via firewall rules; deploy authentication at network boundary using VPN or bastion host access; enable detailed audit logging of all file transfer operations, authentication attempts, and resource access; consider disabling the service if not operationally essential; establish real-time monitoring for anomalous access patterns and failed authentication attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attac
Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which
Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentic
Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. Rat
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an att
Exploit-DB