IBM WebSphere Application Server - Liberty versions 22.0.0.11 through 26.0.0.5 contain a vulnerability (CVE-2026-5516) that could allow a remote attacker with high privileges to bypass security controls by exploiting a timing window. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is published but lacks an official remediation level or patch information.

The vulnerability could allow an attacker with high privileges to bypass security protections, potentially leading to unauthorized access to confidential information. There is no impact on data integrity or system availability. No known exploits have been reported, indicating limited or no active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM advisories for updates and consider limiting exposure of affected versions to untrusted networks. No vendor-provided mitigation or temporary fix is currently documented.