CVE-2026-7253 is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918 affecting IBM Watson Speech Services Cartridge, specifically within the Sterling File Gateway used by the speech runtimes. An authenticated attacker with low privileges can exploit this flaw to send unauthorized requests from the affected system, which may lead to network enumeration or assist in other attack vectors. The vulnerability is assigned a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. IBM has addressed the vulnerability, but no direct patch or official remediation level is provided in the data.

An authenticated attacker with low privileges can exploit this SSRF vulnerability to send unauthorized requests from the system hosting IBM Watson Speech Services Cartridge 4.0.0. This may allow the attacker to enumerate internal network resources or facilitate further attacks. The confidentiality of information can be compromised, but integrity and availability are not impacted according to the CVSS vector.

IBM has addressed this vulnerability; however, no explicit patch or remediation instructions are provided in the available data. Users should consult the official IBM security advisories or support channels for the latest patch or mitigation guidance. Until a patch is applied, restrict authenticated access to trusted users only to reduce risk.