CVE-2026-3621 describes an improper privilege management vulnerability (CWE-269) in IBM WebSphere Application Server - Liberty editions 17.0.0.3 through 26.0.0.4. The issue arises when applications are deployed without authentication and authorization configured, enabling identity spoofing under limited conditions. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. IBM has published the vulnerability but has not released a patch or official remediation details. This vulnerability affects on-premises deployments, not cloud services.

Successful exploitation could allow an attacker to spoof identities, potentially leading to unauthorized access and full compromise of confidentiality, integrity, and availability of the affected application server. The impact is rated high due to the potential for complete system compromise under the specified conditions. However, exploitation requires the application to be deployed without authentication and authorization, which may limit exposure.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, ensure that all applications deployed on WebSphere Application Server - Liberty have proper authentication and authorization configured to prevent exploitation of this identity spoofing vulnerability.