CVE-2025-66483 MEDIUM

CVE-2025-66483: Multiple vulnerabilities have been addressed in IBM Aspera Shares

Vendor Ibm

Product Aspera Shares

Weakness CWE-613 · Insufficient session expiration

Published April 1, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66483 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/613.html