IBM Aspera HSTS CVE-2026-9035

Exploitation requires a valid authenticated user account on the IBM Aspera High-Speed Transfer system, confirmed by the CVSS vector PR:L (low privileges required). The vulnerability is triggered via the asperahttpd HTTP component specifically - other Aspera transfer interfaces are not described as affected. No special server-side configuration is needed beyond a standard deployment; however, exploitation is limited to users who can authenticate to the service. Network access to the asperahttpd port is required (AV:N). Key limiting factors: unauthenticated external attackers cannot exploit this without first obtaining valid credentials; the scope is confined to confidentiality (no write or denial-of-service primitive); and SSVC rates the vulnerability as non-automatable, indicating bulk exploitation against large target populations is not straightforward.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation with low complexity and no user interaction required, but mandates at least low-privileged authentication (PR:L), which meaningfully limits the attacker pool to credentialed users. The high confidentiality impact (C:H) reflects the ability to read arbitrary files, which in a file-transfer server context could expose credentials, cryptographic material, or sensitive transferred data. SSVC rates this as non-automatable with partial technical impact and exploitation status of none - consistent with the authentication prerequisite preventing mass automated scanning. No CISA KEV listing and no identified public exploit code further reduce near-term urgency. There is no score conflict between CVSS and SSVC signals; both converge on a real but non-critical, authenticated-only threat. The primary realistic risk is insider threat or compromised account abuse rather than opportunistic external exploitation.

An attacker who holds a valid low-privileged Aspera user account sends a crafted HTTP request to the asperahttpd component containing path traversal sequences (e.g., '../../etc/passwd' or similar) to escape the authorized file transfer directory and retrieve sensitive files from the server's local filesystem such as configuration files, SSH keys, or other user data. No public proof-of-concept code has been identified at time of analysis, but the straightforward nature of CWE-22 path traversal means the technique is well understood by practitioners and manual exploitation does not require specialized tooling.