IBM WebSphere CVE-2026-10842

The affected component must be a running IBM WebSphere Application Server Traditional 8.5/9.0 or Liberty 17.0.0.3-26.0.0.7 instance that is network-reachable and that relies on declarative security constraints to protect resources; the attack targets those protected resources by reaching them via an alternate name/path representation (CWE-289) not covered by the constraint. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special deployment mode are required against affected versions, so exploitation is limited mainly by whether the instance is reachable by the attacker and whether it actually defines security constraints protecting sensitive resources; impact is confined to confidentiality (I:N/A:N), meaning data disclosure rather than modification or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with reading protected data through a bypassed constraint rather than modifying it or crashing the server. No EPSS score, KEV entry, SSVC decision, or POC was provided in the input, so exploitation-probability signals are absent: this should be treated as no public exploit identified at time of analysis, not as low-risk. The balance of signals - trivially reachable and unauthenticated, but confidentiality-only and disclosed/patched by the vendor rather than exploited in the wild - makes this a genuine patch priority for internet-facing WebSphere deployments, though its real-world exploitation likelihood cannot be quantified without EPSS data. Note the practical impact depends on what the bypassed constraints protect; that specific detail is not in the description and should be verified against the IBM advisory.

A remote attacker who can reach the WebSphere HTTP(S) listener sends a request for a protected resource using an alternate representation of its path or method that the security-constraint logic fails to match, and the server serves the resource without enforcing authentication or authorization. Because no privileges or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker retrieves confidential data directly. No public exploit code was identified at time of analysis.