IBM Aspera High‑Speed Transfer Server for Cloud Pak for Integration versions 1.5.1 through 1.5.19 contain an authentication bypass flaw that allows a client to read files stored on the server’s local disk when certain restriction settings are not enabled. The CVE description does not specify that the vulnerability allows modification or deletion of files; such capabilities are not asserted.

IBM Aspera High‑Speed Transfer Server for Cloud Pak for Integration 1.5.1 to 1.5.19 are affected. Versions 1.5.20 and later are not impacted, as the patch removes the bypass logic.

The CVSS score of 9.1 reflects a severe impact, while the EPSS score of <1% indicates a low but not zero probability of exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers need network reach to the vulnerable endpoints and can send a crafted request that satisfies the authentication checks without valid credentials, thereby gaining read access to the server’s local files. The description infers that exploitation would proceed along these lines; the exact attack steps are not fully detailed in the advisory, so the assumption about the crafted request is inferred.