What is the CVSS score of CVE-2026-8180?

CVE-2026-8180 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM Aspera are affected by CVE-2026-8180?

IBM Aspera High-Speed Transfer service (versions 3.7.4-4.4.7 Fix Pack 1) is vulnerable to unauthenticated remote denial of service, allowing attackers to crash the asperahttpd service without…

How to fix or mitigate CVE-2026-8180?

Within 24 hours: Identify all systems running IBM Aspera versions 3.7.4-4.4.7 Fix Pack 1 and assess network accessibility of asperahttpd service. Within 7 days: Implement firewall rules to restrict network access to asperahttpd and contact IBM for patch availability and upgrade timelines. Within 30 days: Execute upgrade to unaffected IBM Aspera versions or implement and validate compensating controls if upgrade is unavailable.

IBM Aspera CVE-2026-8180

EUVD-2026-32499 HIGH

NULL Pointer Dereference (CWE-476)

2026-05-27 psirt@us.ibm.com

GHSA-fqw5-w9px-94f7

Denial Of Service Null Pointer Dereference IBM

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:14 vuln.today

DescriptionCVE.org

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential denial of service in the asperahttpd component. An unauthenticated user can cause the asperahttpd service to crash.

AnalysisAI

Remote denial of service in IBM Aspera High-Speed Transfer Endpoint and High-Speed Transfer Server (versions 3.7.4 through 4.4.7 Fix Pack 1) allows an unauthenticated network attacker to crash the asperahttpd service via a NULL pointer dereference. Exploitation requires no credentials and no user interaction, yielding a complete loss of availability for the affected transfer service. There is no public exploit identified at time of analysis, and the issue has no confidentiality or integrity impact.

Technical ContextAI

IBM Aspera is a high-speed managed file transfer suite built on the FASP protocol; the affected piece is asperahttpd, the embedded HTTP daemon that fronts the High-Speed Transfer Server/Endpoint (typically used for HTTP/HTTPS fallback and web-based transfer setup). The root cause is classified as CWE-476 (NULL Pointer Dereference), meaning the daemon dereferences a pointer that was never initialized or had been set to NULL - most plausibly while parsing an attacker-supplied request - causing the process to fault and terminate. Because asperahttpd is a network-facing listener, the defect is reachable directly over the network without any authenticated session. No CPE strings were supplied in the input; affected product identification therefore relies on the NVD/EUVD version ranges rather than machine-readable CPE entries.

RemediationAI

Apply the fix described in the IBM advisory at https://www.ibm.com/support/pages/node/7273615; the provided data does not include an exact fixed version number, so administrators should consult that advisory for the specific Fix Pack/release that supersedes 4.4.7 Fix Pack 1 and verify it before deploying. Until patched, reduce exposure of the asperahttpd HTTP listener: restrict access to the asperahttpd port to trusted source networks via firewall or ACLs, place the service behind a reverse proxy or VPN, and disable the HTTP/HTTPS fallback transfer path if it is not required in your deployment (trade-off: clients that rely on HTTP fallback or web-based transfer setup will lose that capability and may fail behind restrictive firewalls). Because the impact is a crash, also configure service auto-restart/monitoring so the daemon recovers quickly, while recognizing this does not prevent repeated re-triggering by an attacker.