CVE-2026-15887 is a server-side request forgery (SSRF) vulnerability classified under CWE-918 affecting IBM WebSphere Application Server versions 8.5 and 9.0. The flaw occurs during the processing of SOAP requests, allowing an attacker with low privileges to cause the server to send crafted requests to internal or external systems without proper authorization checks. The vulnerability has a CVSS 3.1 score of 5.4, reflecting its medium impact on confidentiality and integrity, with no impact on availability.

An attacker with limited privileges can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially accessing internal resources or services that are otherwise inaccessible. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor IBM's advisories for updates. Until a fix is available, restrict access to the affected SOAP interfaces and apply network-level controls to limit the server's ability to make arbitrary outbound requests.