IBM Aspera HSTS CVE-2026-9035

Apply the vendor-released fix documented in IBM security advisory at https://www.ibm.com/support/pages/node/7273615 - the exact patched version is not present in the available intelligence data and must be confirmed directly from that advisory before upgrade planning. Until patching is complete, compensating controls include restricting network access to the asperahttpd service port to known trusted IP ranges via firewall rules, which limits the authenticated attack surface to a smaller set of potential abusers; the trade-off is reduced accessibility for legitimate remote users. Additionally, audit and enforce the principle of least privilege on all Aspera user accounts - accounts with minimal transfer permissions reduce the value of any file read achieved. Monitoring asperahttpd access logs for path traversal patterns (repeated '../' sequences or requests targeting '/etc/', '/var/', or credential directories) provides early detection. Note that path normalization at a reverse proxy (e.g., nginx) in front of asperahttpd could neutralize traversal sequences but introduces deployment complexity and should be tested against Aspera's protocol requirements.