IBM WebSphere Liberty CVE-2026-16192

The restConnector-2.0 feature must be explicitly enabled in the Liberty server configuration. The attacker must possess valid credentials with low privileges (as reflected by PR:L in the CVSS vector). No user interaction is required, and the attack can be mounted over the network against the REST API. If the feature is not enabled, the server is not vulnerable.

CVSS 3.1 score 7.1 (High) with AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H indicates a network-exploitable, low-complexity DoS requiring low privileges. However, no EPSS probability, CISA KEV listing, or public exploit code has been reported, suggesting that real-world exploitation is not yet observed and may be limited to targeted scenarios. The absence of KEV and exploit data means the vulnerability's weaponization status is unknown. Given the widespread deployment of WebSphere Liberty in enterprise environments, the risk is primarily from authenticated insiders or compromised accounts that could trigger service disruption. Without a known in‑the‑wild exploitation signal, the immediate priority may be lower compared to vulnerabilities with active attacks, though patching should proceed routinely.

An authenticated attacker with low‑privilege credentials sends a crafted REST request to the restConnector-2.0 endpoint, which triggers uncontrolled recursion in the request processing logic. The recursion consumes excessive server memory or CPU, causing the application server to become unresponsive and denying service to legitimate users.