What is the CVSS score of CVE-2026-7253?

CVE-2026-7253 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Ibm Watson Speech Services Cartridge are affected by CVE-2026-7253?

IBM Watson Speech Services Cartridge versions 4.0.0-5.3.1 contains a server-side request forgery vulnerability (CVSS 8.8) allowing authenticated users to enumerate internal network infrastructure and…

How to fix or mitigate CVE-2026-7253?

24 hours: Conduct complete inventory of Watson Speech Services Cartridge deployments; identify affected versions (4.0.0-5.3.1) and document all user accounts and service accounts with access. 7 days: Implement firewall rules restricting outbound connectivity from Watson services to only whitelisted internal hosts; enable request-level logging to detect SSRF indicators (encoded URLs, internal IP range access). 30 days: Monitor IBM security advisories for patch availability; develop and test upgrade procedure in non-production environment; schedule deployment of patched version upon release.

Ibm Watson Speech Services Cartridge CVE-2026-7253

EUVD-2026-38266 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-22 ibm

GHSA-4pm6-4pwh-f3gg

SSRF IBM Ibm Watson Speech Services Cartridge

6.0

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.0 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable SSRF needing a low-privilege account (PR:L); strong read/enumeration exposure (C:H) but only partial integrity impact and no inherent availability loss given the described enumeration/pivot outcome.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Severity Changed

Jul 22, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jul 22, 2026 - 19:22 NVD

8.8 (HIGH) 6.0 (MEDIUM)

Analysis Updated

Jun 30, 2026 - 14:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 14:52 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 14:52 NVD

5.3 (MEDIUM) 8.8 (HIGH)

Analysis Generated

Jun 22, 2026 - 16:09 vuln.today

DescriptionCVE.org

IBM Watson Speech Services Cartridge is vulnerable to Server-Side Request Forgery (SSRF) in Sterling File Gateway, due to a flaw which may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks [GHSA-rr7j-v2q5-chgv] [CVE-2026-7253]. IBM Sterling File Gateway is used in our speech runtimes. This vulnerabilitiy has been addressed. Please read the details for remediation below.

AnalysisAI

Server-Side Request Forgery in IBM Watson Speech Services Cartridge (versions 4.0.0 through 5.3.1) lets an authenticated attacker coerce the system into issuing crafted requests to internal or external hosts, enabling internal network enumeration and pivoting toward follow-on attacks. The weakness lives in the embedded IBM Sterling File Gateway component used by the speech runtimes (GHSA-rr7j-v2q5-chgv). No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and CISA SSVC marks exploitation as none, so this is a patch-priority issue rather than an emergency.