WebSphere Liberty CVE-2026-5516

Exploitation requires the attacker to hold a high-privilege authenticated session on the IBM WebSphere Liberty server (CVSS PR:H), ruling out unauthenticated or low-privileged exploitation. The attack must be conducted over the network (AV:N) but requires precise timing coordination (AC:H) to hit the vulnerable window - this is not a fire-and-forget exploit. No user interaction is required once the attacker is authenticated (UI:N). The specific Liberty feature, endpoint, or configuration that introduces the vulnerable timing window is not disclosed in available data - the IBM advisory at https://www.ibm.com/support/pages/node/7273425 should be consulted for configuration-specific guidance. Exploitation is limited to confidentiality impact (I:N, A:N), meaning integrity and availability of the server are not at risk. Versions outside the range 22.0.0.11-26.0.0.5 are not listed as affected.

The overall real-world risk is moderate-to-low despite the C:H confidentiality impact. Several CVSS components heavily constrain exploitability: AC:H requires precise timing coordination, which is difficult to achieve reliably in remote network scenarios; PR:H confirms the attacker must already hold high-level authenticated access to the Liberty instance before exploitation is possible. EPSS data was not provided in the source intelligence - exploitation probability cannot be quantified. No CISA KEV listing exists, and no public POC has been identified, meaning opportunistic or commodity threat actors are unlikely to operationalize this at scale. The practical threat profile is a privileged insider or a compromised high-privilege account attempting to escalate or access data they should not reach. The CVSS score of 4.4 (Medium) is broadly consistent with these constraints. One signal worth noting: the tag 'Authentication Bypass' combined with PR:H is unusual - a high-privilege user bypassing further security controls suggests possible privilege separation or authorization policy enforcement failure rather than an authentication mechanism bypass in the traditional sense. Defenders should treat this as a targeted, low-automation threat.

A remote attacker who has already obtained high-privileged credentials to a Liberty instance (e.g., via credential theft or insider access) initiates a sequence of operations timed to exploit a race condition in the server's security enforcement path. During the brief window when the security check and the resource access are not atomically synchronized, the attacker's request is processed with bypassed access controls, allowing them to read sensitive application data or configuration they would otherwise be denied. No public POC exists at time of analysis, meaning reliable exploitation requires custom tooling and precise timing, limiting this primarily to skilled, targeted adversaries.