CVE-2026-8175: Multiple vulnerabilities in Aspera applications.

Synopsis

A buffer overflow vulnerability affects the asperahttpd component in IBM Aspera High-Speed Transfer Endpoint and High-Speed Transfer Server (versions 3.7.4 through 4.4.7 Fix Pack 1). The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially accessible to any network-adjacent attacker. Successful exploitation can crash the service, bypass authentication controls, or enable full remote code execution on the affected host. No fix versions have been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable asperahttpd component is exposed over the network, so an attacker must be able to reach it via a network connection to exploit this flaw.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can send a malformed request to the vulnerable component as an unauthenticated party.

• Victim interactionNot required

  Exploitation is fully remote and automated; no user on the target system needs to open a file, click a link, or take any other action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or knowledge of memory layout.

Blast Radius

• A successful attacker achieves remote code execution on the host running asperahttpd, gaining full control of the process and its operating context.
• The attacker reads any data accessible to the asperahttpd process, including in-transit file transfer content and any cached credentials or session tokens.
• Authentication controls in the Aspera transfer service can be bypassed, allowing the attacker to initiate or intercept high-speed file transfers without valid credentials.
• The asperahttpd service can be crashed outright, interrupting all file transfers and any dependent workflows for the duration of the outage.