IBM WebSphere Application Server EUVD-2026-75747

No authentication is required; the CVSS PR:N confirms unauthenticated exploitation. The attacker must be able to reach the WebSphere HTTP/HTTPS listener over the network (AV:N). No user interaction is needed. Exploitation is limited to directing outbound requests from the server - the attacker cannot directly read arbitrary files or execute code. Impact is bounded by what internal services the WebSphere host can reach and whether those services return data reflected to the attacker. Non-default deployments with strict outbound egress filtering or no externally exposed WebSphere listener substantially reduce exploitability.

The CVSS 5.3 medium score reflects a realistic assessment: confidentiality impact is limited (C:L) and neither integrity nor availability are affected (I:N/A:N). The network, no-auth, no-complexity vector (AV:N/AC:L/PR:N/UI:N) maximizes accessibility, meaning any internet-exposed WebSphere listener is reachable without credential setup - a meaningful concern for perimeter-exposed deployments. No EPSS score was provided in the input data, and the CVE is absent from CISA KEV, suggesting no confirmed active exploitation. No POC is referenced. Real-world risk is elevated in environments where WebSphere has network access to internal APIs, cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), or microservice backends that trust the application server implicitly. For organizations where WebSphere is behind a WAF or internal-only, risk is substantially reduced. This is not a theoretical critical flaw - it is a legitimate medium-priority finding requiring patching with compensating controls in the interim.

An unauthenticated attacker sends a crafted HTTP request to a publicly accessible IBM WebSphere endpoint that includes a user-controlled URL parameter. WebSphere processes the request and issues an outbound connection to an attacker-specified destination - such as an internal microservice, an intranet admin panel, or the AWS EC2 instance metadata endpoint - and the response may be reflected back or observable via timing differences, leaking limited internal network topology or cloud credential data. No public exploit code is referenced in the available data.