WebSphere Liberty CVE-2026-95696

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are required - a remote attacker needs only network reachability to an affected WebSphere Application Server Liberty instance (versions 20.0.0.12 through 26.0.0.10). The limiting factors are: impact is confined to availability (no data exposure or code execution), and exploitation requires that the vulnerable Liberty service be network-exposed to the attacker. The exact feature, endpoint, or request type that raises the uncaught exception is not described in the available sources, so whether a non-default configuration or specific component must be enabled cannot be confirmed from the provided data.

Signals are largely consistent and point to a genuine but moderate availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated condition with high availability impact and no confidentiality or integrity impact - a pure denial-of-service profile consistent with the CWE-400 (uncontrolled resource consumption) classification and the 'uncaught exception' described by IBM. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no POC reference in the input, and SSVC records Exploitation: none. The EPSS score is low (0.32%, 23rd percentile), indicating no observed exploitation activity or weaponization to date. SSVC does flag Automatable: yes with Technical Impact: partial, which aligns with a scriptable DoS that degrades availability rather than yielding full system compromise - this is why vuln.today assigns a 'this_week' priority rather than an emergency one. In short, this is a legitimately high-CVSS issue by availability metrics but a moderate real-world priority: the lack of exploitation evidence, low EPSS, and DoS-only impact temper urgency, while the unauthenticated network vector and automatable nature justify timely patching rather than deferral. One caveat: the input does not describe the exact trigger (which request, protocol, or feature raises the uncaught exception), so the practical ease of exploitation cannot be fully confirmed from available data.

A remote, unauthenticated attacker sends a specially crafted request over the network to a reachable WebSphere Liberty endpoint, triggering an uncaught exception that disrupts processing and renders the service unavailable to legitimate users. Because the flaw is unauthenticated and low-complexity (AV:N/AC:L/PR:N) and SSVC marks it automatable, the request could be scripted and repeated to sustain the outage. No public exploit code or POC reference is present in the available data, and the exact triggering input is not described in the sources.