What is the CVSS score of EUVD-2026-83041?

EUVD-2026-83041 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-83041?

Yes, a patch is available for EUVD-2026-83041. Update the affected software to the latest version immediately.

WebSphere Application Server EUVD-2026-83041

| CVE-2026-11537 MEDIUM

Trusting HTTP Permission Methods on the Server Side (CWE-650)

2026-09-18 ibm

GHSA-wm4h-7wjf-j25r

Information Disclosure IBM Websphere Application Server

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Adjacent vector for an admin FileTransfer servlet (AV:A), no auth/interaction per vendor (PR:N/UI:N), and confidentiality-only path disclosure (C:L, I:N, A:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 16:43 vuln.today

CVE Published

Sep 18, 2026 - 16:10 nvd

MEDIUM 4.3

DescriptionCVE.org

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

AnalysisAI

File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires reaching the WebSphere FileTransfer servlet, which is an administrative/node-management component of the WebSphere runtime rather than a typical application endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely low-priority issue despite being a network-adjacent flaw in a ubiquitous enterprise product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor fix; IBM has published remediation guidance for this issue at https://www.ibm.com/support/pages/node/7286610, with the patch status reported as available from the vendor (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report.