EUVD-2026-100491
GHSA-wp7q-jrp6-gm2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitReach enabled restConnector-2.0 REST endpoint
-
ExecutionIssue request exceeding authorization
-
ImpactEscalate privileges on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the restConnector-2.0 feature (the Liberty JMX REST management connector) to be explicitly enabled in the server configuration - it is not active in a bare default server.xml, which meaningfully limits the exposed population. The attacker must also already hold valid low-privilege authenticated access (PR:L) to the server; this is not a remote unauthenticated flaw. Affected builds are Liberty 17.0.0.3 through 26.0.0.9. No end-user interaction is needed (UI:N). Defenders can reduce risk by disabling restConnector-2.0 where unused and restricting network access to the management endpoint. |
| Impact | This is a medium-severity (CVSS 5.4) authorization flaw (CWE-863) in IBM WebSphere Application Server Liberty, exploitable only when the restConnector-2.0 feature is enabled. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L), i.e. an already-authenticated but limited user who can elevate privileges. Impact is limited (C:L/I:L, A:N), consistent with partial rather than total compromise. There is no CISA KEV listing, no reported public POC, and no EPSS score was supplied, so there is no signal of active or widespread exploitation - this reads as a priority-to-patch-but-not-emergency issue rather than a critical drop-everything flaw. Note a mild tension between the 'Authentication Bypass' tag and the underlying weakness: CWE-863 and the 'privilege escalation' framing point to improper authorization for an authenticated user (PR:L), not a pre-authentication bypass; treat the authentication-bypass label with caution and verify against IBM advisory node 7291394. No EPSS data was provided, so exploitation probability cannot be quantified from the input. |
| Exploit ScenarioDerived | An authenticated low-privilege user with access to a Liberty server that has the restConnector-2.0 (JMX REST) feature enabled sends crafted requests through the REST management connector to perform actions beyond their authorization level, escalating to higher privileges. No user interaction or special client is required. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9) allows an authenticated low-privileged user to bypass authorization checks and carry out management operations beyond their assigned role, but only on servers where the optional restConnector-2.0 feature has been explicitly enabled. It carries a medium CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) as a CWE-863 improper authorization flaw, meaning credentials are required, no user interaction is needed, and impact is limited to low confidentiality and integrity loss with no availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposure is meaningfully limited because a bare default server.xml does not enable this connector.
RemediationAI
No exact fixed version is specified in the available intelligence; IBM's advisory at https://www.ibm.com/support/pages/node/7291394 should be consulted to obtain the patched Liberty release or interim fix for the affected 17.0.0.3 through 26.0.0.9 range, and that update is the primary remediation. In the meantime, the most effective compensating control is to disable the restConnector-2.0 feature by removing it from the server.xml featureManager list wherever JMX REST management is not in active use - the trade-off is that any tooling, monitoring integration, or administration script that depends on the REST connector will stop working until the feature is re-added and the server restarted. Where the connector must remain enabled, restrict network reachability to its HTTPS management port so that only trusted administrative subnets or jump hosts can connect, which reduces the attack surface but requires firewall or network ACL changes and can interrupt remote automation; additionally enforce least privilege on all accounts that can authenticate to the connector and audit them for unexpected privilege use, and review whether any low-privileged or service accounts currently hold access they should not. Because exploitation is authenticated and requires the feature to be enabled, closing unused connector endpoints and tightening access controls materially lowers risk while the vendor fix is applied, but neither measure replaces patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the restConnector-2.0 feature of WebSphere Application Server Liberty, IBM's lightweight Java EE/Jakarta EE runtime. restConnector-2.0 exposes the Liberty JMX MBean layer as a remote REST over HTTPS administrative interface, giving operators programmatic read and configuration access to server internals; because it is an optional feature it is only reachable when explicitly listed in the server's featureManager configuration, so the vulnerable surface is not present in an out-of-the-box default server. The root cause class is CWE-863 (Incorrect Authorization): the connector's REST endpoints fail to enforce proper privilege separation, so a caller holding only low-privileged authenticated access (reflected by PR:L in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is able to invoke operations that should require elevated administrative rights, yielding low but real confidentiality and integrity impact on the managed server's configuration and state. The scope is unchanged (S:U), no availability impact (A:N) was assessed, and no user interaction (UI:N) is needed. IBM PSIRT is the originating reporter (EUVD-2026-100491), and the vulnerability is tracked as an authentication bypass / privilege escalation issue in the Liberty management connector rather than a flaw in the core application runtime or in end-user deployed applications.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST connector (AV:N, AC:L), but requires an existing authenticated low-privilege account (PR:L) and the feature enabled; partial confidentiality/integrity impact, no availability impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB