IBM WebSphere Application Server EUVD-2026-83280

Exploitation requires network reachability to the IBM WebSphere Application Server administrative console (versions 8.5 or 9.0) and targeting specific console functions where authorization checks are missing (CWE-862); per the vendor vector no authentication is required (PR:N). The high attack complexity (AC:H) indicates the attacker must satisfy specific, non-trivial conditions or possess knowledge of the affected console paths rather than a trivial single request. Practical exposure is limited because admin consoles are commonly deployed on restricted management networks rather than internet-facing, and impact is confined to low-confidentiality information disclosure with no integrity or availability effect (C:L/I:N/A:N).

This is a low-severity information-disclosure issue, and the multi-source signals are consistent in pointing to low real-world priority. The vendor CVSS of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects network reach and no-authentication access (missing authorization checks, CWE-862), but is capped by high attack complexity (AC:H), confidentiality-only low impact (C:L), and no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation is not observed or automated. The description ('obtain sensitive information from the administrative console due to missing authorization checks') aligns with the CVSS vector - network vector plus C:L only, no conflict to flag. Note the input Tag 'Authentication Bypass' is inconsistent with CWE-862 (missing authorization is an access-control/authorization flaw and the effect is information disclosure, not authentication bypass); this is a metadata labeling problem, not a scoring conflict. Overall: a genuine but minor bug best handled via normal patch cadence, not emergency response.

A remote attacker reaches a network-accessible WebSphere administrative console and issues requests to specific console functions that fail to enforce authorization, returning fragments of sensitive configuration or environment information without valid credentials. The high attack complexity (AC:H) implies the attacker needs specific knowledge of the vulnerable console paths or conditions, and only limited-confidentiality data is exposed. No public exploit code is identified at time of analysis.