CVE-2026-7876Critical· 9.1▾ MidnightIBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.
aspera_high-speed_transfer_server_for_cloud_pak_for_integration >= 1.5.1, < 1.5.20Upgrade past the affected range:
aspera_high-speed_transfer_server_for_cloud_pak_for_integration 1.5.20Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93744Medium· 6.5IBM i Improper Authentication
CVE-2026-107400High· 8.8Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
CVE-2026-17488Medium· 4.3IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
CVE-2026-53709Critical· 9.8MCP Context Forge is an MCP gateway and administrative platform
CVE-2026-95680High· 8.0IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
CVE-2026-93907High· 8.1IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.