CVE-2026-15280 is a path traversal vulnerability (CWE-22) affecting IBM WebSphere Application Server - Liberty ND Collective Controller versions 17.0.0.3 through 26.0.0.8. The issue arises from improper limitation of a pathname to a restricted directory via path-segment injection in the collective routing mechanism. This flaw could allow an unauthenticated attacker to access sensitive files or directories outside the intended scope, impacting confidentiality. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability remotely without authentication or user interaction to access restricted directories or files, potentially exposing sensitive information. The impact is limited to confidentiality compromise; integrity and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected components and monitoring for unusual access patterns related to the collective routing mechanism.