IBM WebSphere Application Server EUVD-2026-51230

Exploitation requires only network reachability to a WebSphere Application Server 9.0/8.5 or Liberty 17.0.0.3-26.0.0.7 HTTP listener and the ability to send a single crafted HTTP request - no authentication, no user interaction, and no non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description does not name a specific optional feature or configuration mode as a precondition, so this behaves as a default-configuration issue on any exposed HTTP transport. The primary limiting factor is network exposure: instances not reachable from an untrusted network, or fronted by a WAF/proxy enforcing request-rate and size limits, are materially harder to attack, and the impact is confined to availability with no data or integrity exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an easy, remote, unauthenticated, single-request attack with high availability impact but no confidentiality or integrity loss - a classic network DoS profile. This is not KEV-listed and no public exploit is identified, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified from available data. The realistic priority is moderate-to-high for internet-facing WebSphere instances (the low attack complexity and no-auth requirement mean it is easy to weaponize once details emerge), but the impact ceiling is availability only - there is no data theft or code execution. Because it is a DoS affecting a widely deployed enterprise middleware platform, patching internet-exposed instances promptly is warranted, while purely internal instances behind rate-limiting/WAF controls carry lower urgency. No SSVC decision fields were supplied, so automatability and technical-impact classifications are inferred from the CVSS vector rather than confirmed.

An attacker locates an internet-facing WebSphere or Liberty HTTP endpoint and, without any credentials, sends one carefully crafted HTTP request that triggers uncontrolled resource consumption on the server. The server's threads, memory, or connection pool are exhausted, causing it to stop serving legitimate traffic; the request can be repeated to sustain the outage. No public exploit code is identified at time of analysis, but the low attack complexity means a reliable script could be developed quickly once technical details circulate.