What is the CVSS score of CVE-2025-66485?

CVE-2025-66485 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-66485?

Yes, a patch is available for CVE-2025-66485. Update the affected software to the latest version immediately.

IBM CVE-2025-66485

EUVD-2025-209182 MEDIUM

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-04-01 ibm

XSS IBM

5.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 23:16 euvd

EUVD-2025-209182

Analysis Generated

Apr 01, 2026 - 23:16 vuln.today

Patch released

Apr 01, 2026 - 23:16 nvd

Patch available

CVE Published

Apr 01, 2026 - 23:01 nvd

MEDIUM 5.4

DescriptionNVD

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

AnalysisAI

HTTP header injection in IBM Aspera Shares 1.9.9 through 1.11.0 allows authenticated attackers to conduct cross-site scripting, cache poisoning, and session hijacking attacks via improper validation of HOST headers. The vulnerability requires authenticated access and carries a CVSS score of 5.4 with moderate confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

IBM Aspera Shares is vulnerable to HTTP header injection due to insufficient input validation of HOST headers (CWE-644: Improper Validation of HTTP Request Header Fields). This class of vulnerability occurs when user-supplied data is included in HTTP response headers without proper sanitization, allowing attackers to inject arbitrary header values. The affected technology spans Aspera Shares versions 1.9.9 through 1.11.0. The vulnerability can be chained with browser-based attacks such as XSS when injected headers influence how user content is rendered, or exploited to manipulate cache behavior and session tokens through header manipulation.

RemediationAI

Upgrade IBM Aspera Shares to version 1.11.1 or later, as patches are available from IBM per vendor advisory at https://www.ibm.com/support/pages/node/7267848. Immediately apply the security update to all deployed instances, prioritizing systems handling sensitive data or exposed to untrusted user populations. Review HTTP header handling in proxy and load balancer configurations to ensure no downstream systems are replicating unsanitized HOST headers. If immediate patching is not feasible, restrict access to Aspera Shares to trusted internal networks and audit authentication logs for suspicious header manipulation attempts.

More from same product – last 7 days

CVE-2026-7524 CRITICAL Act Now

9.8 May 27

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr

CVE-2026-8175 CRITICAL Act Now

9.8 May 27

Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra

CVE-2026-7876 CRITICAL Act Now

9.1 May 27

Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu

CVE-2026-5065 HIGH This Week

8.8 May 27

Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded

CVE-2026-8179 HIGH This Week

8.8 May 27

Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)

CVE-2025-66485 vulnerability details – vuln.today

Back