CVE-2026-7876 describes an authentication bypass vulnerability in IBM Aspera HSTS for CP4I versions 1.5.1 through 1.5.19. The vulnerability enables a transfer client to circumvent authentication controls and access unauthorized files on the server's local storage when certain restriction settings are not applied. This issue is categorized as CWE-287, indicating improper authentication mechanisms. The CVSS v3.1 base score is 9.1, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. No official patch or remediation guidance is currently provided by IBM, and the product is not a cloud service, so remediation depends on vendor updates or configuration changes.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files stored locally on the affected server. Confidentiality and integrity of data are at high risk, while availability is not impacted. This could result in data exposure or unauthorized data manipulation by an attacker without needing any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that all recommended restriction settings are properly configured to limit access controls on the server. Monitor IBM's advisories for updates on patches or official mitigations.