Cyber Resilience

CVE-2026-7876

CriticalUpdated

Published: 27 May 2026

Published
27 May 2026
Modified
11 June 2026
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0031 23.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-7876 is a critical-severity Improper Authentication (CWE-287) vulnerability in Ibm Aspera High-Speed Transfer Server For Cloud Pak For Integration. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have…

more

access to, when specific restriction settings are not in place.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CWE-287 improper authentication in public-facing IBM Aspera service directly enables remote exploitation via T1190.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4101Same vendor: Ibm
CVE-2024-22347Same vendor: Ibm
CVE-2023-49886Same vendor: Ibm
CVE-2026-9170Same vendor: Ibm
CVE-2026-8644Same vendor: Ibm
CVE-2025-36365Same vendor: Ibm
CVE-2024-41787Same vendor: Ibm
CVE-2025-13915Same vendor: Ibm
CVE-2026-1343Same vendor: Ibm
CVE-2025-33077Same vendor: Ibm

Affected Assets

ibm
aspera high-speed transfer server for cloud pak for integration
1.5.1 — 1.5.20

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-287

Detects unauthorized successful logons resulting from improper authentication implementations.

addresses: CWE-287

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

addresses: CWE-287

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

addresses: CWE-287

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

addresses: CWE-287

Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.

addresses: CWE-287

Session content review can reveal authentication bypasses or failures in session establishment.

addresses: CWE-287

Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.

addresses: CWE-287

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

References