What is the CVSS score of CVE-2026-8175?

CVE-2026-8175 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM are affected by CVE-2026-8175?

IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1) contain a critical remote code execution vulnerability allowing unauthenticated attackers to compromise…

How to fix or mitigate CVE-2026-8175?

24 hours: Complete inventory of all IBM Aspera deployments identifying affected versions (3.7.4-4.4.7 Fix Pack 1); immediately implement network access controls restricting connectivity to asperahttpd services. 7 days: Deploy intrusion detection rules, disable non-essential remote management, enable full audit logging on Aspera components, and restrict administrative access. 30 days: Subscribe to IBM security advisories for patch notification; establish upgrade plan to 4.4.8 or later once released; prepare isolated test environment for patch validation prior to production deployment.

IBM CVE-2026-8175

EUVD-2026-32496 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-05-27 psirt@us.ibm.com

GHSA-gwr3-hqj9-gxmf

RCE Denial Of Service Buffer Overflow Heap Overflow Authentication Bypass IBM

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:49 vuln.today

DescriptionCVE.org

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could be exploited to cause a denial of service and potentially lead to authentication bypass or remote code execution.

AnalysisAI

Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Transfer Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1) through a heap-based buffer overflow in the asperahttpd component. An unauthenticated network attacker can corrupt memory to crash the service (denial of service) and, in the worst case, hijack execution flow to run arbitrary code or bypass authentication. There is no public exploit identified at time of analysis and SSVC lists exploitation as none, but the CVSS 9.8 rating and 'Automatable: yes' assessment mark this as a high-priority patching target.