CVE-2025-66487 LOW

CVE-2025-66487: Multiple vulnerabilities have been addressed in IBM Aspera Shares

Vendor Ibm

Product Aspera Shares

Weakness CWE-770 · Uncontrolled resource consumption

Published April 1, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

2.7/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66487 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html