EUVD-2026-98686
GHSA-hqx9-hfrg-3qwc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebSphere endpoint over network
-
ExploitSend crafted resource-exhausting requests
-
ImpactExhaust CPU/memory/connections causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required: a remote attacker need only reach a network-exposed WebSphere Application Server (Liberty 17.0.0.3 through 26.0.0.10, or traditional WAS 8.5/9.0). The description does not name the specific endpoint, protocol, or feature that triggers the uncontrolled resource consumption, so the exact triggering surface is not confirmed from available data. The principal limiting factor is network exposure - instances restricted to internal networks or behind rate-limiting/WAF/reverse-proxy controls are materially harder to exploit - and impact is confined to availability (no data compromise or code execution). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a network-reachable, low-complexity, unauthenticated flaw with no user interaction and availability-only impact (C:N/I:N) - consistent with the CWE-400 uncontrolled resource consumption described. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no positive signal of active exploitation or weaponization. This is therefore a genuinely remotely-triggerable DoS but, absent exploitation evidence, it is a patch-in-normal-cadence availability issue rather than an emergency: the 7.5 is driven entirely by availability, with zero confidentiality or integrity impact. The key missing signals (EPSS, KEV, POC) mean likelihood of exploitation cannot be quantified from the data provided; prioritization should weight the exposure of the affected WebSphere instance (internet-facing vs. internal) more than the raw CVSS. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted or high-volume requests to an exposed IBM WebSphere Application Server (Liberty or traditional 8.5/9.0) endpoint, causing the server to consume excessive resources (CPU, memory, or connections) until it becomes unresponsive and legitimate users are denied service. No public exploit was identified at time of analysis, and because impact is availability-only, the attacker gains disruption but no code execution or data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote denial of service affecting IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.10) and traditional IBM WebSphere Application Server 8.5 and 9.0, where uncontrolled resource consumption lets a network-reachable attacker degrade or exhaust server availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms no authentication or user interaction is required and that impact is confined to availability, with no confidentiality or integrity loss. At the time of analysis no public exploit code has been identified for this issue, and CISA KEV does not list it as confirmed actively exploited; IBM has published a vendor fix via its support advisory at https://www.ibm.com/support/pages/node/7292214.
RemediationAI
Primary fix: apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7292214 - the input confirms a patch is available from the vendor but does not provide an exact fixed version, so confirm the precise build on that page for your Liberty or WAS 8.5/9.0 installation rather than assuming a version number. Because this is an unauthenticated network-reachable availability flaw, compensating controls are worthwhile while patching: restrict the administrative and application listeners to trusted networks using firewalls or security groups, and place a reverse proxy or WAF in front of exposed instances with connection and request-rate limits - the trade-off is potential throttling of legitimate high-volume clients and added latency. Enable request-size and concurrency limits at the proxy layer (for example, maximum concurrent connections and maximum request body size) to blunt uncontrolled consumption, recognizing that aggressive limits may cause false-positive client failures. Continuously monitor thread pools, heap, and connection counts on exposed instances and alert on abnormal growth, understanding that this is detection, not prevention, and will not stop a determined high-volume attacker. Do not rely on authentication as a mitigation, since the vector is PR:N and the endpoint does not require credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-400 (Uncontrolled Resource Consumption): the server fails to bound a resource - such as threads, memory, connections, or request-processing capacity - in response to crafted network input, allowing a single remote client or a small number of requests to consume disproportionate server resources and drive the application server into an unavailable state. Affected CPE data identifies cpe:2.3:a:ibm:websphere_application_server_-_liberty (all versions) and cpe:2.3:a:ibm:websphere_application_server (all versions), which aligns with the advisory covering Liberty 17.0.0.3 through 26.0.0.10 and traditional WAS 8.5 and 9.0. The assessment notes the specific endpoint, protocol, or feature that triggers the exhaustion is not named in available data, so defenders should treat the full externally reachable request surface as potentially in scope while the patch is applied. The PR:N vector means any host that can open a TCP connection to an exposed listener can attempt the attack, making network reachability the principal gating factor.
Know when Websphere Application Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated resource-exhaustion with no user interaction yields AV:N/AC:L/PR:N/UI:N; impact is availability-only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Executive ViewAI
IBM WebSphere Application Server (both Liberty and traditional versions) is vulnerable to an unauthenticated remote denial-of-service attack that can degrade or exhaust server availability. This puts critical business applications and services hosted on WebSphere at risk of downtime, potentially disrupting customer-facing operations and internal workflows. Leadership should prioritize patching because the vulnerability requires no authentication or user interaction, making it easy to exploit if an attacker gains network access, though no public exploit code is currently identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Websphere Application Server
View allIBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Co
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown i
Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unau
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network at
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Exploit-DB