IBM Aspera Orchestrator
CVE-2025-13211
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitIssue rapid email-triggering requests
-
ExecutionOverwhelm email service (no rate limiting)
-
ImpactDenial of service of email function
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Interaction frequency control
|
| Exploitation Conditions | Requires a valid authenticated session on IBM Aspera Orchestrator (CVSS PR:L confirms low-privilege authentication is needed), with network reachability to the application. The flaw is specifically in the email service, which lacks proper control of interaction frequency (rate limiting), allowing an authenticated user to flood email-generating operations. Limiting factors: exploitation cannot be performed unauthenticated, impact is confined to the availability of the email service (no data disclosure or modification), and only versions 4.0.0 through 4.1.0 are affected. The exact account role required is not specified in the available data. |
| Impact | This is a moderate-severity, availability-only issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack requiring low-privilege authentication (PR:L), with impact limited strictly to availability (A:H) of the email service and no confidentiality or integrity impact. The EPSS score of 0.36% (27th percentile) is low, indicating no significant observed exploitation interest. There is no CISA KEV listing and no public exploit identified at time of analysis, so this reflects no public exploit identified at time of analysis. No SSVC decision data was provided in the input. The signals are internally consistent: a low-privilege authenticated DoS against a single subsystem (email), reported by IBM PSIRT, with low exploitation probability - this is a real but contained operational issue, not a high-risk mass-exploitation candidate. The main caveat is that the required privilege level is confirmed only as 'low' via CVSS PR:L, and the exact account/role needed to reach the email service is not detailed in the available data. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on IBM Aspera Orchestrator abuses the email service's lack of interaction-frequency control (CWE-799) by issuing email-triggering actions at high volume. The resulting flood exhausts or overwhelms the email service, denying that functionality to legitimate users. No public exploit code is known, and exploitation requires a valid authenticated session, limiting the attacker population. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to degrade or exhaust the product's email service by repeatedly triggering email-generating operations faster than the service can process them, because the application does not properly control interaction frequency (CWE-799). The defect is availability-only - there is no data disclosure or modification - and exploitation requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), so remote unauthenticated attackers cannot trigger it. EPSS places it at roughly 0.36% (27th percentile) and no public exploit code has been identified; this is a moderate-severity issue that should be prioritized behind higher-impact findings.
RemediationAI
No vendor-released fixed version is supplied in the available data, so the first action is to consult IBM's advisory at https://www.ibm.com/support/pages/node/7254434 for the current fix level, upgrade path, and any interim guidance specific to Aspera Orchestrator 4.0.0-4.1.0, and apply the vendor-supplied update as soon as it is published. Because the vulnerability is an unthrottled email path reachable by any authenticated account, effective compensating controls until patching are: restrict which accounts can reach the Orchestrator email/notification functionality and audit role assignments so that only necessary operators retain access (this reduces the attacker pool but does not eliminate the risk from a legitimate low-privilege user); front the Orchestrator interface with a reverse proxy or WAF configured to rate-limit requests to the endpoints that generate email, accepting the trade-off that aggressive thresholds may throttle legitimate workflow notifications; and apply outbound throttling or queue limits on the SMTP relay the Orchestrator uses so a flood degrades only a bounded mail queue rather than the mail subsystem itself, at the cost of delayed legitimate notification delivery. Where email notification is non-essential, disabling the email service entirely removes the exposure. Monitoring for bursts of mail-dispatch events from a single session can provide early detection, though it is a detective rather than preventive measure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-799, Improper Control of Interaction Frequency, the class of weakness in which an application fails to throttle, queue, or otherwise bound how often a user can invoke a resource-intensive action. Here the affected subsystem is the Aspera Orchestrator email service, which processes and dispatches notification/workflow email; without rate limiting, session-level quotas, or back-pressure, a single authenticated account can repeatedly invoke the email-generating path and saturate the mail subsystem, causing denial of service for legitimate notifications. The CPE string cpe:2.3:a:ibm:aspera_orchestrator:*:*:*:*:*:*:*:* identifies the affected offering as IBM Aspera Orchestrator itself (workflow orchestration layer for high-speed Aspera transfer environments) with no version constraint in the CPE, so version scoping must come from the vendor advisory, which limits the exposure to releases 4.0.0 through 4.1.0. This is a classic resource-consumption weakness rather than a memory-safety or injection defect: no code execution, credential exposure, or integrity impact is involved, and the CVSS environmental scope is unchanged (S:U), confining the effect to availability of the email service.
Know when Aspera Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable email service abuse needs a low-privilege authenticated account (PR:L), low complexity, with impact limited to availability (A:H) and no confidentiality or integrity effect.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
More in Aspera Orchestrator
View allAuthenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the applica
SQL injection in IBM Aspera Orchestrator 4.0.0 through 4.1.0 lets an authenticated attacker with low privileges send cra
IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows an authenticated remote user to change another user's password withou
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to information disclosure if una
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to conduct various attacks again
GitHub PoC
Exploit-DB