CVE-2025-66486 is a medium severity vulnerability affecting IBM Aspera Shares versions 1.9.9 through 1.11.0. It involves improper neutralization of script-related HTML tags (CWE-80), allowing remote attackers with high privileges and requiring user interaction to inject malicious HTML code. When a victim views the injected content, the malicious code executes within the security context of the hosting site, potentially leading to information disclosure or other impacts limited to the confidentiality and integrity of the affected system. The vulnerability has a CVSS 3.1 score of 4.8, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality and integrity but not availability. No patch or official remediation has been published by IBM as of the data provided.

The vulnerability allows an attacker with high privileges and requiring user interaction to inject and execute malicious HTML code in the context of the affected IBM Aspera Shares web application. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information accessible in the browser session or manipulation of displayed content. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting access to affected versions and exercising caution with user-generated content in IBM Aspera Shares. Monitor IBM's security advisories for updates on patches or official mitigations.