What is the CVSS score of CVE-2026-2482?

CVE-2026-2482 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of WebSphere Liberty are affected by CVE-2026-2482?

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 contain a request-forgery vulnerability enabling attackers to coerce authenticated users into performing unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-2482?

Within 24 hours, inventory all IBM WebSphere Liberty deployments and identify instances running versions 17.0.0.3 through 26.0.0.8, then assess business criticality and user populations of affected systems. Within 7 days, obtain and deploy the patch to a test environment, validate compatibility with custom applications and configurations, and plan production rollout sequencing. Within 30 days, execute phased production deployment across all Liberty instances and confirm patching completion.

WebSphere Liberty CVE-2026-2482

EUVD-2026-50448 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-29 ibm

GHSA-rxf7-xjqf-rhqf

CSRF IBM Websphere Application Server Liberty

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

Vendor (ibm) PRIMARY

LOW

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

CSRF cannot read cross-origin responses, limiting confidentiality; I:H reflects unauthorized state-change execution; A:L acknowledges incidental availability risk from forged destructive operations.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 14:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 14:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 14:23 NVD

LOW HIGH

CVSS changed

Aug 04, 2026 - 14:23 NVD

3.1 (LOW) 8.8 (HIGH)

Analysis Generated

Jul 29, 2026 - 18:51 vuln.today

DescriptionNVD

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

AnalysisAI

Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a web application processes requests without verifying that they were intentionally submitted by the authenticated user, relying solely on ambient credentials such as session cookies. IBM WebSphere Application Server Liberty (CPE: cpe:2.3:a:ibm:websphere_application_server_-_liberty:*:*:*:*:*:*:*:*) is a modular, lightweight Java EE/Jakarta EE application server widely used in enterprise environments. The flaw indicates absent or bypassable CSRF token validation within Liberty's request handling pipeline, meaning cross-origin state-changing requests are processed as legitimate when they carry a valid session context from the victim's browser.

RemediationAI

Apply the vendor-released patch per IBM security advisory at https://www.ibm.com/support/pages/node/7281651; exact fixed version should be confirmed directly from that page, as no specific fix version was included in the available intelligence data. As a compensating control prior to patching, enforce the SameSite=Strict or SameSite=Lax attribute on Liberty session cookies to prevent cross-origin cookie transmission - note that SameSite=Lax still permits top-level navigations with GET, so it is a partial mitigation only. Additionally, deploying a reverse proxy or WAF with CSRF token enforcement upstream of Liberty endpoints can reduce exposure, though this adds operational overhead. Restricting Liberty administrative endpoints to internal network segments limits the attacker's ability to deliver a forged request from an external page.