Multiple vulnerabilities in Aspera applications._CVE-2026-9035

6.5 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.

Basic Information

ID CVE-2026-9035

Source ibm

Published May 27, 2026 at 13:21

Affected Product

Vendor IBM

Product Aspera High-Speed Transfer Endpoint

Version 3.7.4

Affected Versions IBM Aspera High-Speed Transfer Endpoint 3.7.4
IBM Aspera High-Speed Transfer Server 3.7.4

CWE Classification

CWE-22

References

www.ibm.com /support/pages/node/7273615

{
    "lastseen": "",
    "description": "IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server\u2019s local storage that they should not have access to.",
    "published": "2026-05-27T13:21:43.995Z",
    "modified": "2026-05-27T13:21:43.995Z",
    "type": "cve",
    "title": "Multiple vulnerabilities in Aspera applications.",
    "source": "ibm",
    "references": "https://www.ibm.com/support/pages/node/7273615",
    "id": "CVE-2026-9035",
    "bulletinFamily": "",
    "cwe": [
        "CWE-22"
    ],
    "cvelist": null,
    "sourceData": "IBM Aspera High-Speed Transfer Endpoint 3.7.4\nIBM Aspera High-Speed Transfer Server 3.7.4",
    "sourceHref": "",
    "cvss": {
        "score": 6.5,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Aspera High-Speed Transfer Endpoint",
    "version": "3.7.4",
    "vendor": "IBM",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}