Vulnerability intelligence

CVE-2026-9035

IBM Aspera High-Speed Transfer Endpoint CWE-22

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.

CVSS Score

6.5

Medium

EPSS — Exploit Probability

0.3%

Riskier than 25% of all CVEs · checked 2026-09-07

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published