What is the CVSS score of CVE-2026-1561?

CVE-2026-1561 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2026-1561?

CVE-2026-1561 presents moderate security risk, a server-side request forgery vulnerability rated CVSS 5.4. Users could be tricked into performing unintended actions.. A patch is available.

How to fix or mitigate CVE-2026-1561?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

IBM CVE-2026-1561

EUVD-2026-15982 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-25 ibm

IBM SSRF

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 20:32 euvd

EUVD-2026-15982

Analysis Generated

Mar 25, 2026 - 20:32 vuln.today

Patch released

Mar 25, 2026 - 20:32 nvd

Patch available

CVE Published

Mar 25, 2026 - 20:10 nvd

MEDIUM 5.4

DescriptionCVE.org

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

AnalysisAI

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3 contain a server-side request forgery (SSRF) vulnerability that allows authenticated remote attackers to send unauthorized requests from the vulnerable system. This exposure could enable network enumeration, internal service discovery, or facilitate secondary attacks against internal infrastructure. A patch is available from IBM, and the vulnerability requires authenticated access (PR:L) but has low attack complexity, making it a medium-priority issue for organizations running affected Liberty instances.

Technical ContextAI

The vulnerability exists in IBM WebSphere Application Server Liberty, a lightweight Java EE application server runtime. The affected component improperly handles user-supplied input when constructing outbound HTTP requests, failing to validate or restrict the target URL or destination. This is classified under CWE-918 (Server-Side Request Forgery), which describes a flaw where the server fetches remote resources without proper validation of the resource location. The affected versions span from 17.0.0.3 through 26.0.0.3 (CPE: cpe:2.3:a:ibm:websphere_application_server_liberty:*:*:*:*:*:*:*:*), indicating the issue persists across multiple years of releases. The vulnerability likely resides in a feature or service handler that processes external requests and re-issues them without sufficient URL sanitization or destination filtering.

RemediationAI

Apply the vendor-supplied patch immediately by upgrading IBM WebSphere Application Server Liberty to a version greater than 26.0.0.3, following IBM's official release notes and patch guidance available at https://www.ibm.com/support/pages/node/7267347. If immediate patching is not feasible, implement network-level controls to restrict outbound connections from Liberty instances to known, approved internal and external destinations using firewall rules or web application firewall policies. Additionally, audit access logs for suspicious outbound requests and restrict user privileges where possible to minimize the attack surface. Monitor for any indicators of SSRF exploitation such as unexpected outbound connections to internal IP ranges or metadata services (e.g., 169.254.169.254 on cloud platforms). After patching, validate the fix by reviewing Liberty security bulletins and re-testing affected application endpoints.