The vulnerability allows an authenticated user to send emails without proper rate limiting, which can result in email flooding or a denial of service. This weakness enables a legitimate user to exhaust system resources by sending large volumes of mail, potentially disrupting service availability for all users.

IBM Aspera Shares versions 1.9.9 through 1.11.0 are affected. The issue is addressed in version 1.11.1, which includes a fix that implements proper rate limiting for email sending.

The CVSS score of 2.7 indicates a low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be an authenticated user with the ability to send emails, and the attack vector is likely internal. While the impact on availability is significant, the overall risk remains modest due to the low base score and exploitation probability.