EUVD-2026-100489
GHSA-w359-m8h5-3c98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privilege credentials
-
ExploitReach restConnector-2.0 JMX REST endpoint
-
ExecutionTrigger information-disclosure condition
-
ImpactHarvest sensitive data from response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the restConnector-2.0 feature (the JMX REST connector used for remote administration) be explicitly enabled in the Liberty server configuration - it is not part of a minimal default server, so servers without this feature are not exposed. The attacker must also hold valid credentials: per the CVSS vector PR:L, authenticated access to the management interface is mandatory, with no pre-authentication path. Affected versions are 17.0.0.3 through 26.0.0.9. Limiting factors that reduce realistic risk: the non-default management feature dependency, the authentication requirement, and that impact is limited to information disclosure (no integrity or availability loss). |
| Impact | This is a moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation but requires at least low-level authentication (PR:L), and impact is confined to confidentiality (C:H) with no integrity or availability effect - consistent with CWE-209 (information exposure, typically via error messages or diagnostic output). No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified; per precision rules this is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both agree the attacker must be authenticated and that the feature restConnector-2.0 must be enabled. The main uncertainty is real-world exposure: because exploitation depends on a non-default management feature and valid credentials, this is more plausibly an insider/post-authentication exposure than a mass-exploitable pre-auth flaw, which tempers the network vector. Treat as a standard patch-cycle item, prioritized higher where the JMX REST connector is exposed to broadly-trusted users. |
| Exploit ScenarioDerived | An attacker holding valid low-privilege credentials to a Liberty server that has the restConnector-2.0 feature enabled issues requests to the JMX REST management endpoint and obtains sensitive information disclosed by the server (consistent with CWE-209 error/diagnostic exposure). No public exploit code is identified at time of analysis, and the network attack vector with low complexity means no special tooling or user interaction is needed beyond authenticated access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 lets an authenticated remote user retrieve sensitive server information when the restConnector-2.0 administrative feature is enabled. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the issue requires valid credentials against the management interface and results in confidentiality loss only, with no integrity or availability impact; because restConnector-2.0 is not part of a minimal default Liberty server, deployments that never enabled it are not exposed. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than an emergency.
RemediationAI
No vendor-released patch identified at time of analysis, so the immediate action is to check the IBM support advisory at https://www.ibm.com/support/pages/node/7291394 (also reachable via https://nvd.nist.gov/vuln/detail/CVE-2026-14909) for the current Liberty fix pack or interim fix covering versions 17.0.0.3 through 26.0.0.9, and apply it as soon as IBM publishes an exact fix level; IBM typically addresses such issues through Liberty fix packs, so verify the refreshed runtime version rather than assuming a configuration change alone is sufficient. Until a patch is applied, the single most effective compensating control is to disable the restConnector-2.0 feature in server.xml on any instance that does not require remote JMX/REST administration - the trade-off is loss of remote administrative scripting and monitoring against that server, so this is only practical for deployments managed locally. Where remote administration must be retained, restrict network access to the management HTTPS port so that only trusted administrator networks or bastion hosts can reach it (implemented via firewall rules or host-level ACLs); the trade-off is that any legitimate admin traffic outside those ranges is blocked and must be tunneled. Additionally, reduce the blast radius by reviewing which accounts currently have access to the management interface and trimming unnecessary credentials, since exploitation requires valid low-privilege authentication, and monitor Liberty logs and connector access for unusual retrieval of diagnostics or error responses from the restConnector endpoints as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the IBM WebSphere Liberty restConnector-2.0 feature, the JMX REST connector that exposes a REST/HTTPS management endpoint for remote server administration (for example server configuration, MBean inspection, and administrative operations). The root cause class is CWE-209, Generation of Error Message Containing Sensitive Information: responses produced by the connector - typically diagnostic or error output - can include sensitive internal data that should not be returned to the caller. Because this is a management-plane feature rather than an application-facing one, exposure depends entirely on server configuration: a Liberty profile without restConnector-2.0 enabled does not instantiate the affected endpoint. The CVSS vector confirms network reachability (AV:N) with low attack complexity (AC:L) but requires low-privilege authentication (PR:L) and no user interaction (UI:N), and scopes impact to confidentiality only (C:H/I:N/A:N), consistent with an information-leak defect that an authorized-but-not-privileged management user can abuse to read data beyond their intended role. The EUVD record (EUVD-2026-100489) mirrors the same affected version range, and the reference set points to the IBM support advisory (https://www.ibm.com/support/pages/node/7291394) as the authoritative source; no CPE identifiers were supplied in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated access to the restConnector management endpoint is required (PR:L) over the network (AV:N) with no special conditions (AC:L); impact is confidentiality-only information disclosure, so I:N/A:N.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB