IBM WebSphere Application Server CVE-2026-15412

The attacker must identify a publicly accessible IBM WebSphere Application Server 9.0 or 8.5 (or Liberty) endpoint that exposes the vulnerable open redirect functionality. Exploitation further requires the attacker to successfully persuade a human victim to click a crafted URL - social engineering is a mandatory step, making this an inherently UI:R vulnerability despite the UI:N CVSS vector in the input. No authentication is required from the attacker. Exploitation is limited to the redirect mechanism itself; the attacker does not gain access to the WebSphere server, its data, or its operating environment. Organizations not exposing WebSphere endpoints to untrusted users (e.g., purely internal deployments with no external-facing login or portal pages) face significantly reduced risk.

The NVD-assigned CVSS 6.5 score reflects moderate severity: unauthenticated network exploitation with low confidentiality and integrity impact and no availability concern. However, there is a material inconsistency in the input vector - UI:N (no user interaction) conflicts directly with the description's explicit requirement that an attacker must persuade a victim to visit a specially crafted URL; this is characteristic of a scoring error, as open redirects inherently require UI:R under CVSS 3.1 semantics. Correcting to UI:R reduces the score further and better reflects real-world exploitability. No EPSS data was provided in the source intelligence, and the vulnerability has no CISA KEV listing and no known public exploit, which significantly reduces urgency for patching in isolation. That said, even a mid-sized municipal IT team in bytom operating an externally accessible WebSphere portal should treat this as a meaningful risk if end users authenticate through that interface, since brand-trust phishing via a legitimate redirect can be highly effective in targeted spear-phishing campaigns. The lack of complexity or privilege requirements means any internet-accessible WebSphere endpoint with the redirect flaw is a viable phishing springboard once discovered.

An attacker identifies an externally accessible IBM WebSphere 9.0 instance belonging to a financial services firm, discovers the vulnerable redirect parameter through reconnaissance or historical vulnerability patterns, and constructs a URL on the target's legitimate WebSphere domain pointing to an attacker-controlled credential-harvesting page. The attacker sends this URL in a targeted phishing email to employees; because the link begins with the organization's trusted domain, security tooling and recipient vigilance are less likely to flag it. No public exploit code has been identified, but no special tooling is required - a crafted URL and a phishing email are sufficient.