CVE-2025-66487 IBM CVE debrief

Who should care

Defenders and administrators responsible for IBM Aspera Shares installations, especially in environments where email flooding or denial of service could have significant impacts.

Why it matters

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where email flooding or denial of service could have significant impacts. The vulnerability allows an authenticated user to send emails at an unlimited frequency, potentially leading to email flooding or denial of service.

• Potential email flooding or denial of service could impact email services and user productivity.
• Verify and apply the vendor's patch for IBM Aspera Shares versions 1.9.9 through 1.11.0 to prevent exploitation.

Technical summary

IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service. The vulnerability allows an authenticated user to send emails at an unlimited frequency, potentially leading to email flooding or denial of service. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where email flooding or denial of service could have significant impacts.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where email flooding or denial of service could have significant impacts.

Recommended defensive actions

• Verify and apply the vendor's patch for IBM Aspera Shares versions 1.9.9 through 1.11.0.
• Implement rate limiting on email sending functionality to prevent email flooding or denial of service.
• Monitor email sending activity for potential abuse or anomalies.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The vulnerability is confirmed in IBM Aspera Shares versions 1.9.9 through 1.11.0. Defenders should verify the affected scope and apply the vendor's patch to prevent exploitation. The CVE Program and NVD provide official records and assessments of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.