IBM WebSphere Liberty EUVD-2026-100496

The available sources do not name a specific feature, protocol, or configuration setting that must be enabled - the description states only an 'incorrect authorization' (CWE-863) condition and does not describe the trigger. Based solely on the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires network reachability to the WebSphere Application Server Liberty instance and no authentication or user interaction against the affected versions (20.0.0.12 through 26.0.0.10). Limiting factors: the instance must be network-exposed to the attacker, the deployment must run an affected Liberty build, and impact is confined to confidentiality and integrity (A:N, no availability/denial-of-service effect). Whether any non-default configuration narrows the exposure is not stated in the available sources and should be verified against the IBM advisory.

Signals conflict and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1) describes a remote, unauthenticated, low-complexity authorization bypass with high confidentiality and integrity impact but no availability impact - a genuinely severe profile. The vuln.today Decision label is 'act_now', consistent with that severity and the unauthenticated network vector. However, exploitation-likelihood signals are modest: EPSS is only 0.33% (24th percentile), CISA SSVC lists Exploitation: none and Automatable: no (with Technical Impact: total), there is no CISA KEV listing, and no public exploit or PoC reference appears in the input. The practical reading: this is a high-priority patching item because of the unauthenticated, network-reachable total-impact potential against an enterprise application server, but there is no evidence of active exploitation or exploit automation at time of analysis - the urgency is driven by severity and exposure, not by observed in-the-wild activity. One caveat: the description ('incorrect authorization', CWE-863) does not explain the trigger mechanism, so the PR:N / AC:L assumptions behind the 9.1 score cannot be independently verified from the available sources and should be confirmed against the IBM advisory.

A remote attacker with network access to an exposed WebSphere Application Server Liberty instance sends requests that exploit the incorrect authorization flaw to bypass security restrictions, reaching resources or operations that should be access-controlled. Because the CVSS vector is PR:N/UI:N, no credentials or user interaction are required, so the attacker can read sensitive data and alter protected state (C:H/I:H) without a foothold. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS metrics rather than demonstrated exploit code.