IBM WebSphere Liberty CVE-2026-77816

Exploitation requires the attacker to hold an active man-in-the-middle position on the network path used by the WebSphere Application Server Liberty administrative client (affected versions 17.0.0.3 through 26.0.0.9) - for example a shared LAN segment, hostile Wi-Fi, compromised gateway/proxy, or an internal lateral foothold. The underlying defect is improper TLS certificate validation (CWE-295) in the administrative client, so the condition is that the client initiates a TLS connection the attacker can intercept and present a fraudulent certificate to. Limiting factors: this is reflected in the HIGH attack complexity (AC:H) - an attacker on the open internet with no interception capability cannot exploit it; network segmentation of administrative traffic, mutual TLS enforcement, or trusted-path administration substantially reduces exposure. No authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a moderate-severity information-disclosure flaw (CVSS 6.5) rather than a top-tier priority. The IBM-provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) tells a consistent story for a CWE-295 improper-certificate-validation issue: the attack is network-based and needs no privileges or user interaction, but carries HIGH attack complexity (AC:H) because the attacker must first achieve a man-in-the-middle position on the network path between the WebSphere Liberty administrative client and its endpoint - a precondition that is not trivially met from the open internet. Confidentiality impact is HIGH (sensitive data exposed) with only LOW integrity impact and no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore gated almost entirely by whether an attacker can position themselves on the relevant network segment (e.g., shared LAN, compromised router, hostile Wi-Fi, or internal lateral position). In a hardened, segmented administrative network the real-world risk is low-to-moderate despite the HIGH confidentiality rating; on a flat or untrusted network it is more meaningful. No key signals are directly conflicting, but note the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input.

An attacker who can intercept traffic between a WebSphere Application Server Liberty administrative client and its target (for example on a shared or compromised network segment) exploits improper TLS certificate validation to transparently proxy the connection. Because the client fails to properly verify the server certificate, the attacker decrypts or relays the administrative session and harvests sensitive information such as credentials or configuration data. No public exploit code was identified in the input, and the HIGH attack complexity reflects the need to first obtain the man-in-the-middle position.