IBM WebSphere Liberty CVE-2026-93895

Exploitation requires that the target WebSphere Liberty instance actually deploys gRPC service(s) AND relies on Liberty-configured access controls on specific gRPC methods - the flaw is that those configured controls are not enforced for unauthenticated remote callers. The limiting factor is deployment-specific: servers that do not expose gRPC services, or that do not depend on method-level access controls, are not meaningfully affected. Where gRPC with access controls is in use, the CVSS metrics (PR:N/UI:N/AC:L/AV:N) indicate no authentication, no user interaction, and no non-default trickery is needed beyond network reachability of the gRPC endpoint. Affected versions span 20.0.0.12 through 26.0.0.10.

This is a genuine high-priority issue by multiple signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, consistent with the description's 'unauthenticated remote attacker' and CWE-284 (Improper Access Control). The 9.1 base score is driven by high confidentiality AND integrity impact (C:H/I:H) with no availability impact (A:N), fitting an access-control bypass that exposes and lets an attacker invoke protected gRPC methods rather than crashing the service. However, NO EPSS exploitation-probability score, NO CISA KEV listing, and NO public POC are present in the provided data, so there is no public exploit identified at time of analysis - the risk is currently theoretical/potential rather than demonstrated in the wild. The signals are therefore internally consistent (all point to easy remote abuse) but exploitation evidence is absent; treat as 'patch promptly' given the trivial attack profile and enterprise footprint, while noting that real-world exploitation has not yet been confirmed. Exploitability also depends on the target actually exposing gRPC services with access controls configured (see exploitation conditions).

An attacker with network access to a WebSphere Liberty server that exposes gRPC services sends requests directly to gRPC methods that are supposed to be protected by configured access controls, and the server fails to enforce those controls, allowing the attacker to invoke restricted methods and read or modify protected data without authenticating. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make exploitation straightforward where gRPC is in use.