Multiple vulnerabilities have been addressed in IBM Aspera Shares

The primary impact of CVE-2025-66487 is a denial-of-service condition. An attacker, having authenticated access to the Aspera Shares system, could exploit this vulnerability by sending a high volume of emails. This flood of emails could overwhelm the system's resources, including mail servers and network bandwidth, rendering the Aspera Shares application unavailable to legitimate users. The attacker does not gain unauthorized access to data, but can effectively disrupt business operations relying on Aspera Shares. While the CVSS score is low, the impact on critical workflows should not be underestimated.

Organizations utilizing IBM Aspera Shares for file transfer and collaboration, particularly those relying on its email notification features, are at risk. Environments with weak authentication controls or shared accounts increase the potential for exploitation.

1. 2026-04-01Disclosure

   disclosure

1. आरक्षित2025-12-02
2. प्रकाशित2026-04-01
3. संशोधित2026-04-02
4. EPSS अद्यतन2026-04-09

The primary mitigation for CVE-2025-66487 is to upgrade to a patched version of IBM Aspera Shares as soon as it becomes available. Until a patch is applied, implement rate limiting on email sending functionality within Aspera Shares. This can be achieved through configuration changes or by deploying a Web Application Firewall (WAF) or proxy server to filter excessive email requests. Monitor email server logs for unusual activity and consider implementing intrusion detection system (IDS) rules to identify potential email flooding attacks. After upgrade, confirm functionality by sending a test email and verifying it is processed correctly.