What is the CVSS score of CVE-2026-15887?

CVE-2026-15887 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-15887?

Yes, a patch is available for CVE-2026-15887. Update the affected software to the latest version immediately.

IBM WebSphere Application Server CVE-2026-15887

EUVD-2026-78056 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-09-14 ibm

GHSA-x739-2h8w-3q46

SSRF IBM Websphere Application Server

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.0 MEDIUM

SSRF inherently crosses trust boundaries (S:C); blind nature limits confidentiality to low and precludes meaningful integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 07:43 vuln.today

CVE Published

Sep 14, 2026 - 19:58 nvd

MEDIUM 5.4

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

AnalysisAI

Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the attacker hold at least low-privileged authenticated access to the IBM WebSphere Application Server SOAP endpoint (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects the authenticated nature of the attack (PR:L), which meaningfully constrains the threat surface to users or service accounts with valid credentials to the SOAP endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor-released patch documented in IBM's security bulletin at https://www.ibm.com/support/pages/node/7286610; this is the primary and recommended remediation. … Detailed patch versions, workarounds, and compensating controls in full report.