EUVD-2025-209020
GHSA-c39w-6qgm-5cp7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-elevated real-world risk despite its 6.5 CVSS score due to several contextual factors: (1) CVSS vector shows low attack complexity (AC:L) and no user interaction needed (UI:N), making it straightforward to exploit once a privileged account is compromised; (2) the PR:H (high privilege required) constraint significantly reduces the attack surface to insider threats and supply-chain compromises where administrative credentials are already breached; (3) the wide version range (17.0.0.3 through 26.0.0.3) suggests potential widespread exposure across many enterprises running WebSphere Liberty; (4) no information about active exploitation in the wild or KEV status is evident from provided intelligence, suggesting this may be a proactive disclosure; (5) the availability of a vendor patch reduces exploitation window for patched systems. Organizations with extensive WebSphere deployments and strict administrative access controls face lower risk, while those with shared administrative accounts or weak credential management face elevated risk. This is a genuine priority for teams managing WebSphere Liberty environments, particularly in regulated industries handling sensitive data. |
| Exploit ScenarioDerived | An insider with regular developer or operator privileges on the WebSphere Liberty console could authenticate and submit specially crafted requests to the administration interface that exploit the access control flaw, allowing them to assume administrative roles without proper authorization verification. Alternatively, an external attacker who has compromised a service account or low-privileged administrative credential through phishing or supply-chain compromise could use this privilege escalation to gain full administrative control of the application server, enabling them to modify deployed applications, access sensitive data, or pivot to other systems. The low attack complexity and absence of user interaction requirements mean this could be automated into post-compromise toolkits used by sophisticated threat actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.3 are vulnerable to privilege escalation due to improper access control (CWE-200: Information Exposure). A privileged user with existing authenticated access to the application server can exploit this vulnerability to gain additional unauthorized access to sensitive resources, potentially leading to information disclosure and integrity violations. While a CVSS score of 6.5 indicates moderate severity, the vulnerability requires high privileges to trigger (PR:H) and has no user interaction requirement, making it exploitable by insiders or compromised administrative accounts.
RemediationAI
Upgrade IBM WebSphere Application Server Liberty to a patched version released by IBM following security advisory node/7267345 available at https://www.ibm.com/support/pages/node/7267345. Contact IBM support to determine the appropriate patched version for your current deployment. Until patching is possible, enforce the principle of least privilege for administrative accounts by restricting the number of users with high-level permissions, implement multi-factor authentication for administrative console access, isolate WebSphere administration ports (typically 9443) to trusted internal networks only, and audit all administrative account activities via centralized logging. Implement network segmentation to prevent lateral movement if an administrative account is compromised. Schedule patching during a controlled maintenance window to minimize business disruption, testing patches in a staging environment first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in IBM WebSphere Application Server Liberty, a lightweight enterprise Java application server supporting Java EE and Jakarta EE standards. The affected versions span a wide range (17.0.0.3 to 26.0.0.3), indicating a regression or design flaw in the access control mechanisms that verify user permissions when accessing application server resources. CWE-200 (Information Exposure Through an Error Message) suggests the root cause involves improper validation or enforcement of role-based access control (RBAC), where authenticated users with one privilege level can escalate to higher privilege roles or access data outside their authorization scope. The network-accessible nature of WebSphere (AV:N) means this is remotely exploitable over standard HTTP/HTTPS ports used for administration consoles and remote management.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.
Executive ViewAI
CVE-2025-14915 presents notable security risk, a information exposure vulnerability rated CVSS 6.5. Sensitive information could be exposed to unauthorized parties. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB