IBM WebSphere Liberty EUVD-2026-40395

The decisive prerequisite is that the apiDiscovery-1.0 feature is explicitly enabled in the Liberty server configuration (featureManager in server.xml); this feature is not part of a default Liberty server, so servers without it are not exploitable regardless of version. The affected build must fall within 17.0.0.3 through 26.0.0.7. Per CVSS the request needs no authentication and no user interaction (PR:N/UI:N) and is reachable over the network (AV:N/AC:L), so the primary limiting factor is the non-default configuration rather than access controls - defenders can substantially de-risk simply by confirming apiDiscovery-1.0 is absent. Actual sensitive-data impact further depends on what internal services and metadata endpoints are reachable from the Liberty host's network position.

The signals conflict and should be weighed together rather than acting on the 9.8 alone. The CVSS vector claims network attack, low complexity, and no privileges with full C/I/A impact, but SSRF impact is typically read/pivot oriented and exploitation is gated on the non-default apiDiscovery-1.0 feature being enabled, so the realistic technical impact is narrower than C:H/I:H/A:H implies (CISA SSVC rates technical impact only 'partial'). EPSS is low (0.19%, 8th percentile), SSVC exploitation is 'none' and not automatable, and there is no KEV listing and no public exploit identified, so this is not currently a mass-exploitation event. Priority is therefore conditional: high urgency for the subset of deployments that actually enable apiDiscovery-1.0 (patch promptly given unauthenticated network reach), lower urgency for the majority that never enable it. Note the mismatch between the near-maximal CVSS and the 'partial' SSVC technical impact plus low EPSS - verify feature usage before treating this as a critical fire drill.

An external attacker identifies an internet-reachable Liberty server with apiDiscovery-1.0 enabled and submits a crafted request that causes the server to fetch an attacker-specified URL. The server issues that request from inside the network, letting the attacker probe internal-only services or retrieve cloud instance metadata credentials. No public exploit is identified at time of analysis, and the low-complexity, no-auth vector means exploitation would be straightforward once the feature's presence is confirmed.