WebSphere Application Server Liberty CVE-2026-3621

Requires deployment of applications on IBM WebSphere Application Server Liberty WITHOUT explicit authentication and authorization configuration in deployment descriptors (web.xml security-constraint/auth-constraint elements or equivalent server.xml application security settings). Attacker must possess existing low-privilege authenticated credentials (PR:L) to the Liberty server or hosted applications. Attack complexity is high (AC:H), suggesting additional prerequisites such as specific timing, race conditions, or deep knowledge of Liberty's identity handling mechanisms are necessary. Exploitation is limited to Liberty instances where developers have not followed security-by-design practices and have deployed applications relying on implicit rather than explicit security controls - a configuration pattern more common in development, testing, or legacy migration scenarios than in properly hardened production environments.

Real-world risk assessment reveals a nuanced threat profile requiring careful interpretation. CVSS 7.5 (High) with AV:N/AC:H/PR:L indicates network-accessible attack requiring high complexity and low-privilege credentials. The AC:H (high complexity) is critical - this is not a point-and-click exploit but requires specific deployment conditions. PR:L means attackers need existing authenticated access, significantly reducing the attack surface compared to unauthenticated vectors. However, the CIA impact triad of H/H/H means successful exploitation yields complete control within scope. No EPSS data provided, but the combination of authenticated requirement, high complexity, and conditional deployment pattern suggests lower probability of widespread automated exploitation. Not present in CISA KEV and no public exploit identified, indicating no confirmed active exploitation. The 'limited conditions' qualifier in the description (applications deployed without auth/authz configured) is a critical risk modifier - this vulnerability primarily threatens environments with security misconfigurations or legacy applications migrated without security hardening. Organizations with mature application security practices (explicit security constraints on all deployments) face minimal risk. Priority should be HIGH for environments with legacy Liberty deployments, development servers accidentally exposed to production networks, or rapid deployment pipelines lacking security review, but MEDIUM for environments with strong configuration management and security-by-design practices.

An authenticated attacker with low-privilege credentials (such as a basic user account or compromised service account) accesses an IBM WebSphere Application Server Liberty instance hosting applications deployed without explicit authentication and authorization configuration. Through manipulation of identity assertion mechanisms or session handling flaws specific to the high-complexity attack path, the attacker spoofs the identity of a privileged user (administrator or application owner). This identity escalation grants complete access to application data, administrative functions, and the ability to modify or destroy application resources within the compromised scope.