EUVD-2026-100490
GHSA-3257-m328-3cx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Reader-role credentials
-
ExploitRequest version information endpoint
-
ExecutionTrigger uncaught exception (integer overflow)
-
ImpactDisclose product version data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Reader-role account on the WebSphere Liberty instance (PR:L), so it is not remote-unauthenticated; an attacker must already hold or compromise low-privilege authenticated access. The affected feature is the version-information retrieval path, where a crafted request triggers an uncaught exception (associated with CWE-190 integer overflow). The limiting factor is the authentication requirement - only principals with at least Reader role can reach the vulnerable code - and the impact is confined to low-sensitivity version/information disclosure (C:L) with no stated integrity or availability effect. Affected range is Liberty 17.0.0.3 through 26.0.0.9. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) shows that exploitation requires existing authenticated access (PR:L, corresponding to the stated Reader role) and yields only low confidentiality impact (version information disclosure) with no integrity or availability impact. No EPSS score, KEV listing, POC reference, or SSVC decision point was supplied in the input, so there are no signals elevating this above its modest CVSS rating. One internal tension is worth flagging: the CWE-190 (Integer Overflow) classification and the 'Integer Overflow' tag, combined with the description's mention of an 'uncaught exception,' would typically suggest an availability/denial-of-service dimension, yet the CVSS vector sets A:N and scores only C:L - verify with IBM whether the uncaught exception can actually disrupt the service or is purely an information-leak side effect. As presented, this is a low-real-risk, authenticated, low-impact information exposure, not an urgent-patch candidate. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Reader-role account on an IBM WebSphere Liberty instance issues a request that retrieves version information, triggering an uncaught exception and exposing product version details. No public exploit code is referenced in the input, and the attacker must first possess valid Reader credentials, limiting this to insiders or attackers with already-compromised low-privilege access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Information disclosure in IBM WebSphere Application Server - Liberty (versions 17.0.0.3 through 26.0.0.9) lets a principal holding only the read-only Reader role send a crafted request to the version-information retrieval path and cause an uncaught exception, rooted in an integer overflow flaw (CWE-190), that exposes version data. Rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the impact is limited to low-sensitivity information disclosure with no stated effect on integrity or availability, and exploitation is not remote-unauthenticated - the attacker must already possess or have compromised a low-privilege authenticated account. No public exploit code and no CISA KEV entry were identified at the time of analysis.
RemediationAI
No vendor-released patch version is specified in the available intelligence; consult the IBM advisory at https://www.ibm.com/support/pages/node/7291394 to obtain the current interim fix or fix-pack level that supersedes Liberty 17.0.0.3 through 26.0.0.9, and treat that page as the authoritative source for the exact patched build before upgrading. Until a fix is applied, the most effective compensating control is to shrink the attack surface: audit the Liberty user registry and remove or downgrade accounts that hold the Reader role unnecessarily, since the flaw is unreachable without at least Reader-level authorization; the trade-off is reduced convenience for monitoring and read-only operational users who legitimately need that role. Where the version-information endpoint is not required by external consumers, restrict it to trusted management networks or a loopback/administrative listener and front it with a WAF rule that blocks malformed version requests, accepting the risk of false positives against legitimate monitoring tooling and automated inventory scanners. Enable uncaught-exception and first-failure logging in Liberty and alert on repeated exception-triggering requests to the version path so that attempted exploitation is at least detectable; note that increased logging carries additional disk and log-management overhead. Because the assessed impact is only low-sensitivity information disclosure with no integrity or availability effect, these mitigations should be scheduled at low priority rather than treated as an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the version-information retrieval path inside IBM WebSphere Application Server - Liberty, a Java-based, lightweight application server runtime. The root cause class is CWE-190 (Integer Overflow or Wraparound): a numeric value derived from the crafted request is handled without sufficient bounds validation, and the resulting arithmetic condition is not caught, so the request handling thread raises an uncaught exception that surfaces version information to the caller. Because the vulnerable code sits behind Liberty's role-based authorization, only principals mapped to the Reader role can reach it, which is consistent with the assessed vector's PR:L (authenticated, low privilege) and the absence of any integrity or availability component in the score. The affected version range, per ENISA EUVD, is WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9; no CPE identifiers or patch-level fix versions were included in the supplied intelligence, so product identification rests on that version range and the IBM advisory at https://www.ibm.com/support/pages/node/7291394.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable with low complexity, but the Reader role mandates PR:L; impact is limited to low-sensitivity version disclosure (C:L), with no observed integrity or availability effect.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB