IBM Aspera EUVD-2026-32497

Exploitation requires the asperahttpd component of IBM Aspera High-Speed Transfer Server or Endpoint (3.7.4 through 4.4.7 Fix Pack 1) to be reachable over the network and the attacker to hold valid low-privilege credentials on the service (CVSS PR:L confirms authentication is required; this is NOT remote-unauthenticated). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factors are therefore the need for prior authentication and the need for the vulnerable asperahttpd HTTP service to be network-accessible to the attacker - deployments that do not expose asperahttpd, or that strictly limit which authenticated users can reach it, substantially reduce realistic risk.

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full impact on the host within an unchanged scope - a genuinely high-severity profile for an internet- or intranet-facing file transfer service. However, the PR:L requirement means an attacker must first hold valid (even low-privileged) credentials on the Aspera service, which meaningfully narrows the practical attacker population versus a PR:N flaw. Tempering the urgency: there is no CISA KEV listing, no POC was reported, and no EPSS probability was supplied, so there is no current signal of active or imminent exploitation. This is a credible priority for organizations exposing asperahttpd to untrusted or semi-trusted users, but it presently reads as a high-CVSS issue without demonstrated exploitation rather than an actively exploited threat - note the EPSS/POC absence is missing data, not confirmation that exploitation is infeasible.

An attacker who has obtained low-privileged credentials for the Aspera service - for example a transfer user account or compromised partner login - connects over the network to the asperahttpd component and submits a crafted, oversized HTTP request field designed to overflow a fixed stack buffer. By controlling the overwritten stack data they redirect execution and run arbitrary code in the service's context, taking control of the transfer host. No public POC was reported, but the low attack complexity (AC:L) and lack of required user interaction make weaponization straightforward for a capable attacker once credentials are in hand.