WebSphere Liberty EUVD-2026-100492

Requires a WebSphere Liberty deployment where multiple server instances share a single installation (a shared/consolidated install topology), and the attacker must already possess low-level privileges (PR:L) on at least one of those co-located servers. The isolation weakness then allows crossing into other servers sharing that install. Limiting factors: exploitation does not apply to single-server or properly segregated installs; AC:H signals that specific shared-install conditions must exist; and the attacker needs a pre-existing authenticated foothold on one server, so this is not remote-unauthenticated against default standalone deployments. Affected only in versions 17.0.0.3 through 26.0.0.10.

This is a genuine but conditional priority rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, base 8.2 High) reflects high confidentiality and integrity impact with a scope change, which correctly captures the cross-server nature of the flaw - an attacker breaching isolation affects servers beyond the one they initially control. However, two metrics meaningfully temper real-world risk: AC:H (high attack complexity, indicating conditions outside the attacker's control such as a specific shared-install topology) and PR:L (the attacker must already hold low-level privileges on one server in the shared install). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the actual nature of the issue - the CWE is CWE-284 (Improper Access Control) and the description describes isolation failure between co-tenant servers, not bypass of an authentication mechanism; treat the tag as loose labeling and verify with IBM advisory node/7292226. Net: a real, high-severity cross-tenant access-control weakness worth prioritizing in multi-server shared-install deployments, but the PR:L + AC:H preconditions make indiscriminate internet-wide exploitation unlikely.

In a shared WebSphere Liberty installation hosting multiple server instances (e.g., a multi-tenant or consolidated hosting setup), a low-privileged actor who controls one Liberty server abuses the insufficient isolation to reach resources belonging to a co-located server sharing the same install. Because scope changes (S:C), the attacker can read and modify data or configuration of the neighboring server beyond their original authorization boundary. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means specific shared-install conditions must be met.