Aspera Shares EUVD-2025-209186

Real-world risk is constrained by multiple factors: the CVSS score of 2.7 reflects low overall severity; the attack vector is network-accessible but requires high-privilege authentication (PR:H), limiting the threat actor population to administrators or accounts with delegated admin capabilities; the impact is availability-only (no confidentiality or integrity) with low severity (A:L); attack complexity is low, meaning the rate-limit bypass is straightforward once authenticated. EPSS probability would be expected to remain low given these prerequisites. SSVC decision framework suggests this is a remediation-defer issue: exploitation is unauthenticated-barrier-dependent and impact is bounded to service degradation. No KEV or public POC data indicates this is not a priority exploit target. Organizations should patch during routine maintenance windows rather than treat as critical.

An authenticated Aspera Shares administrator with malicious intent or a compromised high-privilege account could programmatically submit a large batch of sharing notifications or system-generated emails without encountering rate-limit barriers, flooding downstream mail servers and degrading the platform's ability to deliver time-sensitive sharing invitations and notifications to legitimate users. Attack complexity is low-a simple script iterating email submission API calls would suffice-but exploitation is gated by the requirement for valid high-privilege credentials, making this a targeted insider-threat or post-compromise scenario rather than a mass-exploitation vector.