Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-9035: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Serv

29
Routine
MEDIUM 6.5UPGRADEUPGRADE

CVE-2026-9035 is a medium-severity flaw (CVSS 6.5) affecting aspera high-speed transfer endpoint, aspera high-speed transfer server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.5 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.3% (top 75%)
CISA exploited listNo
WeaknessCWE-22
Published2026-05-27
Last modified2026-06-17
Publisher (CNA): IBM Corporation · Vendor: ibm

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

ibm aspera high-speed transfer endpoint UPGRADE
Affected: >= 3.7.4 and <= 4.4.6 · 4.4.7 · 4.4.7 fixpack1
Fixed in: newer than 4.4.6
Safe to downgrade to: a release before 3.7.4
1. Check installed version
apt-cache policy aspera-high-speed-transfer-endpoint || rpm -q aspera-high-speed-transfer-endpoint || aspera-high-speed-transfer-endpoint --version
2. UPGRADE to newer than 4.4.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade aspera-high-speed-transfer-endpoint
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade aspera-high-speed-transfer-endpoint
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.7.4 (Debian / Ubuntu)
apt-cache madison aspera-high-speed-transfer-endpoint sudo apt install aspera-high-speed-transfer-endpoint=<VERSION_BEFORE_3.7.4> sudo apt-mark hold aspera-high-speed-transfer-endpoint
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list aspera-high-speed-transfer-endpoint sudo dnf downgrade aspera-high-speed-transfer-endpoint-<VERSION_BEFORE_3.7.4> sudo dnf versionlock add aspera-high-speed-transfer-endpoint
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm aspera high-speed transfer server UPGRADE
Affected: >= 3.7.4 and <= 4.4.6 · 4.4.7 · 4.4.7 fixpack1
Fixed in: newer than 4.4.6
Safe to downgrade to: a release before 3.7.4
1. Check installed version
apt-cache policy aspera-high-speed-transfer-server || rpm -q aspera-high-speed-transfer-server || aspera-high-speed-transfer-server --version
2. UPGRADE to newer than 4.4.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade aspera-high-speed-transfer-server
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade aspera-high-speed-transfer-server
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.7.4 (Debian / Ubuntu)
apt-cache madison aspera-high-speed-transfer-server sudo apt install aspera-high-speed-transfer-server=<VERSION_BEFORE_3.7.4> sudo apt-mark hold aspera-high-speed-transfer-server
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list aspera-high-speed-transfer-server sudo dnf downgrade aspera-high-speed-transfer-server-<VERSION_BEFORE_3.7.4> sudo dnf versionlock add aspera-high-speed-transfer-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-9035?

aspera high-speed transfer endpoint: upgrade to newer than 4.4.6; aspera high-speed transfer server: upgrade to newer than 4.4.6. Exact commands for each OS are on this page.

Is CVE-2026-9035 being exploited?

CVE-2026-9035 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-9035 affect?

CVE-2026-9035 affects aspera high-speed transfer endpoint, aspera high-speed transfer server. Severity is medium (CVSS 6.5). IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in t

How urgent is CVE-2026-9035?

Priority 29/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.