EUVD-2026-100499
GHSA-8wqc-ccmq-2r2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Liberty batch endpoint
-
DeliverySubmit crafted serialized payload
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionCorrupt persisted batch job status
-
ImpactDisrupt batch job integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the persisted status of batch job instances, so the affected Liberty server must have the Java Batch / JSR-352 batch management capability (batch persistence) enabled and network-reachable - this is an optional, non-default Liberty feature, which is the primary factor limiting real-world exposure. Where that feature is configured, CVSS AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low attack complexity are required. Limiting factors: only Liberty editions 17.0.0.3 through 26.0.0.10 running the batch feature are affected, and impact is confined to integrity of persisted batch status (C:N) rather than full server compromise. |
| Impact | The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, which on paper is an attractive target. However, the impact is deliberately scoped: C:N, I:H, A:L means no data disclosure and only limited availability effect, with the real damage being integrity corruption of persisted batch job instance status. This is notable because CWE-502 (deserialization of untrusted data) frequently yields remote code execution (which would score C:H/I:H/A:H); here IBM has scoped the consequence to data integrity only, so defenders should treat this as a data-corruption/manipulation issue rather than an RCE, unless the vendor advisory indicates otherwise. No EPSS probability, CISA KEV entry, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimately high-severity integrity flaw worth prioritizing on exposed Liberty servers that use Java Batch, but not a confirmed widespread-exploitation emergency given the absence of EPSS/KEV/POC signals and the narrowed impact. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted serialized data to a Liberty server exposing the Java Batch (JSR-352) management interface, triggering unsafe deserialization that corrupts the persisted status records of batch job instances. No public exploit code is identified at time of analysis, and the attack requires no authentication or user interaction given AV:N/AC:L/PR:N/UI:N, but the server must have the batch feature enabled and reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote attackers can corrupt the persisted status of batch job instances on IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 via a deserialization flaw (CWE-502), rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). Real-world exposure is limited because exploitation requires the optional, non-default Java Batch / JSR-352 batch management and persistence capability to be enabled on a network-reachable Liberty server, and the resulting impact is confined to the integrity of persisted batch state rather than full server compromise. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
RemediationAI
The available intelligence does not specify a fixed version or interim fix, so no vendor-released patch is identified at time of analysis; administrators should treat the IBM advisory at https://www.ibm.com/support/pages/node/7292232 as the authoritative source for the patched fix-pack level and apply it as soon as IBM publishes the target version for their Liberty release line. Because the issue only manifests when the optional Java Batch (JSR-352) batch management feature and its persistence store are configured, the most effective compensating control is to remove or disable that feature on any server that does not genuinely need batch processing - this eliminates the attack surface entirely, at the cost of losing batch job scheduling, restart, and status monitoring until the fix is applied. Where batch must remain enabled, restrict network access to the batch management endpoints and the HTTP ports that front them using firewall rules, reverse-proxy allowlists, or Liberty's own authentication and trusted-proxy/session security settings, accepting that untrusted clients or an open management port would otherwise retain a path to the vulnerable deserialization code. Additionally, monitor and audit batch job repository records for unexpected status changes or anomalous serialized payload submissions, and enable verbose logging around the batch persistence layer to detect tampering, recognizing that such detection is a detective rather than preventive control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-502 deserialization-of-untrusted-data issue in the batch persistence layer of IBM WebSphere Application Server - Liberty. Liberty implements the Java Batch specification (JSR-352), which maintains a job repository that stores job instances, job executions, step executions, and their status/checkpoint data so that long-running batch jobs can be restarted or queried; that persisted state is what this vulnerability targets. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack surface is the network-reachable batch management interface and the untrusted serialized data it accepts, with no authentication and no user interaction needed; the assessed impact vector (C:N/I:H/A:L, S:U) indicates the attacker manipulates the serialized object graph to alter integrity of stored batch status rather than to read data or achieve code execution, which is consistent with a deserialization flaw whose payload is constrained to the batch-state domain. The vulnerability is scoped to Liberty 17.0.0.3 through 26.0.0.10 (EUVD-2026-100499, same range as the IBM advisory), and the practical blast radius is governed by whether the optional Java Batch feature is installed and configured - a non-default capability that most Liberty deployments do not enable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Remote unauthenticated deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is scoped to corrupting persisted batch status, so I:H, A:L, and C:N.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
Executive ViewAI
Organizations running IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 face a high-severity integrity risk if they have enabled the optional Java Batch/JSR-352 batch management and persistence feature on a network-reachable server. An unauthenticated remote actor could corrupt persisted batch job status, potentially disrupting batch-dependent business processes, but the non-default configuration and limited impact reduce broad enterprise exposure. No public exploit identified at time of analysis, and no vendor-released patch is available, so leadership should prioritize configuration discovery and interim network restrictions.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the optional Java Batch/JSR-352 batch management and persistence capability if not required; restrict network access to batch management and persistence endpoints to trusted management networks; isolate affected IBM WebSphere Application Server - Liberty servers; monitor batch state and logs for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB