IBM WebSphere Liberty CVE-2026-78636

Exploitation requires network reach to the IBM WebSphere Application Server Liberty JMX REST connector AND valid low-privilege authentication to it (CVSS PR:L) - it is not reachable by fully unauthenticated attackers. The specific prerequisite is that the JMX REST connector is enabled/exposed and the attacker can submit a request body to it; the flaw lies in unsafe class reflection in that connector's body parser (CWE-470). Limiting factors: the required authentication, the confidentiality-only impact (no integrity or availability effect), and the fact that deployments without the JMX REST connector exposed are not exposed to this vector. Affected versions are 17.0.0.3 through 26.0.0.10; updating to the vendor-fixed level per IBM support node 7295268 removes the exposure.

This is a moderate-severity, authenticated information-disclosure flaw (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The network vector and low attack complexity make it easy to reach once an attacker holds valid credentials, but PR:L means exploitation requires at least low-privilege authentication to the JMX REST connector, which substantially narrows the realistic attacker population. Impact is limited to a low confidentiality loss (C:L) with no integrity or availability effect, consistent with CWE-470 unsafe reflection leaking information rather than enabling code execution. The input provides no EPSS score, no CISA KEV listing, and no PoC reference, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this contrasts with the vendor-assigned severity and the 'this_month' priority label, which together frame this as a plan-and-patch item rather than an emergency. Net assessment: a real but non-urgent priority - a genuine authenticated-disclosure bug in widely deployed middleware, not a high-CVSS-but-illusory issue, yet well short of a drop-everything emergency given the authentication requirement and limited impact.

An attacker who already holds low-privilege credentials for the JMX REST connector sends a crafted request whose body drives unsafe class reflection in the connector's body parser, causing the server to disclose information the attacker should not be able to read. No public exploit code is identified at time of analysis, and the low complexity means the request itself is simple once authenticated. The disclosed data is confidentiality-only, with no integrity or availability consequence.