CVE-2026-7876

CVE-2026-7876: Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration

Vendor Ibm

Product Aspera HSTS for CP4I

Weakness CWE-287 · Improper authentication

Published May 27, 2026

Last update June 11, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

Key dates

02Disclosure timeline

May 27, 2026 CVE published

June 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-7876 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2021-36346 CVE-2025-55171 WeGIA Anonymous Attacker can Delete Arbitrary Image file at endpoint `/html/personalizacao_remover.php` CVE-2025-47275 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2026-11618 DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication CVE-2026-44547 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2