What is the CVSS score of CVE-2026-10571?

CVE-2026-10571 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-10571?

Yes, a patch is available for CVE-2026-10571. Update the affected software to the latest version immediately.

WebSphere Liberty CVE-2026-10571

EUVD-2026-58359 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-08-13 ibm

GHSA-fcg5-434v-xp4q

Deserialization Denial Of Service IBM Websphere Application Server Liberty

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.7 MEDIUM

Adjacent vector and low-privilege requirement confirmed by restConnector admin API access; pure availability impact with no confidentiality or integrity dimension.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 18:37 NVD

5.7 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:52 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

AnalysisAI

Insecure deserialization in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables a low-privileged administrative user to trigger unbounded resource consumption, resulting in denial of service against the application server. The attack requires the restConnector-2.0 administrative feature to be enabled and the attacker to have adjacent network access with valid low-privilege credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-priv admin credentials

Delivery

Gain adjacent network access

Exploit

Target restConnector-2.0 endpoint

Execution

Submit crafted deserialization payload

Persist

Exhaust JVM memory or CPU

Impact

Application server becomes unavailable

Access

Obtain low-priv admin credentials

Delivery

Gain adjacent network access

Exploit

Target restConnector-2.0 endpoint

Execution

Submit crafted deserialization payload

Persist

Exhaust JVM memory or CPU

Impact

Application server becomes unavailable

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) the restConnector-2.0 feature must be explicitly enabled in the Liberty server configuration - this is not a default-on feature; (2) the attacker must possess valid low-privilege Liberty administrative credentials (PR:L per CVSS vector); and (3) the attacker must have adjacent network access to the management port (AV:A per CVSS), meaning they must be on the same network segment, VLAN, or connected administrative subnet - direct internet exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.7 Medium score reflects several meaningful constraints that reduce real-world risk below the raw availability impact suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a low-privilege administrative account on the same network segment as a Liberty server that has restConnector-2.0 enabled crafts a malicious deserialization payload and submits it to the REST management endpoint. The Liberty JVM processes the payload, entering a resource-intensive deserialization cycle that exhausts CPU or heap memory, causing the application server to become unresponsive and denying service to legitimate application users. …
Remediation	A patch is available from IBM per the vendor advisory at https://www.ibm.com/support/pages/node/7283485 - consult this page for the exact fixed version, as a specific patched release number was not confirmed in the input data. … Detailed patch versions, workarounds, and compensating controls in full report.