IBM WebSphere Application Server - Liberty versions 22.0.0.11 through 26.0.0.5 contain a vulnerability (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) that could allow a remote attacker with high privileges to bypass security protections by exploiting a timing window. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is published but no patch or official remediation level has been provided by IBM as of the publication date.

An attacker with high privileges on the network could exploit this timing window vulnerability to bypass security controls, potentially leading to unauthorized access to confidential information. The vulnerability does not affect data integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, monitor IBM's security advisories for updates. Until a patch is available, limit exposure by restricting network access to the affected WebSphere Application Server instances and ensure that only trusted users have high privileges.