What is the CVSS score of CVE-2026-10571?

CVE-2026-10571 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-10571?

Yes, a patch is available for CVE-2026-10571. Update the affected software to the latest version immediately.

WebSphere Liberty CVE-2026-10571

EUVD-2026-58359 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-08-13 ibm

GHSA-fcg5-434v-xp4q

Denial Of Service Deserialization IBM Websphere Application Server Liberty

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.7 MEDIUM

Adjacent vector and low-privilege requirement confirmed by restConnector admin API access; pure availability impact with no confidentiality or integrity dimension.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 18:37 NVD

5.7 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:52 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

AnalysisAI

Insecure deserialization in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables a low-privileged administrative user to trigger unbounded resource consumption, resulting in denial of service against the application server. The attack requires the restConnector-2.0 administrative feature to be enabled and the attacker to have adjacent network access with valid low-privilege credentials. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

IBM WebSphere Application Server - Liberty (CPE: cpe:2.3:a:ibm:websphere_application_server_-_liberty) is a lightweight, modular Java EE/Jakarta EE runtime. The restConnector-2.0 feature exposes a REST-based administrative API used for remote management and monitoring. CWE-502 (Deserialization of Untrusted Data) describes the root cause class: the application deserializes data provided or influenced by an attacker without sufficient validation, allowing crafted payloads to drive the JVM into expensive processing loops or allocate excessive memory. In a Liberty context, this manifests as resource exhaustion rather than arbitrary code execution, consistent with the CVSS A:H/C:N/I:N profile. The affected version range spans from 17.0.0.3 through 26.0.0.8, representing approximately nine years of releases.

RemediationAI

A patch is available from IBM per the vendor advisory at https://www.ibm.com/support/pages/node/7283485 - consult this page for the exact fixed version, as a specific patched release number was not confirmed in the input data. As an immediate compensating control, disable the restConnector-2.0 feature in server.xml if remote REST-based administration is not operationally required; this eliminates the attack surface entirely but removes remote administrative connectivity. If restConnector-2.0 must remain enabled, restrict access to the REST management port at the network level to only authorized administrative hosts or management VLANs, reducing exposure given the AV:A attack vector. Privileged access management controls should ensure low-privilege admin accounts are tightly scoped and monitored for anomalous API activity.