CVE-2026-8179: Multiple vulnerabilities in Aspera applications.

Synopsis

A buffer overflow vulnerability affects IBM Aspera High-Speed Transfer Endpoint and High-Speed Transfer Server (versions 3.7.4 through 4.4.7 Fix Pack 1) in the asperahttpd component. The vulnerability is reachable over the network and requires a low-privilege authenticated account, with no user interaction needed. Successful exploitation gives an attacker full arbitrary code execution on the affected system. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable asperahttpd component is exposed over the network, so an attacker must be able to reach the service across a network connection.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient to trigger the buffer overflow; no administrative credentials are needed.

• Victim interactionNot required

  No action from a logged-in user or administrator is required for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code in the context of the asperahttpd process, gaining full control over the affected host.
• Confidentiality impact is high: the attacker can read any data accessible to the process, including in-flight file transfer data and credentials stored on the system.
• Integrity impact is high: the attacker can write, modify, or delete files and configuration on the host.
• Availability impact is high: the attacker can crash or permanently disable the Aspera transfer service.