CVE-2026-7876 is a critical (CVSS 9.1) authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration, versions 1.5.1 through 1.5.19. A transfer client may reach files in local server storage. IBM fixed it in 1.5.20. Upgrade, and review restriction settings.
What's affected
- Product: IBM Aspera High-Speed Transfer Server (HSTS) for Cloud Pak for Integration (CP4I).
- Affected: 1.5.1 through 1.5.19.
- Fixed: 1.5.20.
- Weakness: CWE-287, improper authentication.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Not listed in CISA KEV.
IBM says the bypass applies when specific restriction settings are not in place. The bulletin lists no workarounds or mitigations.
How to check if you're exposed
Check the installed chart or product version in your cluster and compare it with 1.5.20.
Then review the restriction settings on your transfer server, such as limits on which paths and users a transfer client can reach. The bulletin does not name them, so use the IBM bulletin and your product documentation to see which settings apply to you. A server with no restrictions in place is the one to fix first.
Write down what you find, with the owner, version and network exposure of each instance. After you patch, check again and record the fixed version, so the next advisory starts from a current inventory. You can also paste a dependency manifest into the free scan at gold.safeguard.sh/scan for any packaged components that sit alongside this product.
What to do now
- Find your Aspera HSTS for CP4I version.
- Upgrade to 1.5.20 through your charts, as IBM describes.
- Review and tighten transfer restriction settings so that clients only reach the storage they need.
- Review transfer logs for access to files that clients should not touch.
Why it matters
IBM describes an authentication bypass that lets a transfer client reach local storage it should not. The condition is that restrictions are not set, so the flaw compounds a loose configuration.
File transfer servers hold large amounts of data that moves between organisations. Treat their restriction settings as part of the security boundary, and verify them after every upgrade.
Quick check
Is there a workaround?
IBM lists none. Upgrade to 1.5.20.
Sources
Last reviewed: 19 October 2026.
