CVE-2026-77816: CWE-295 Improper Certificate Validation in IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server - Liberty versions from 17.0.0.3 up to and including 26.0.0.9 contain an improper certificate validation vulnerability (CWE-295) in the administrative client. This flaw could be exploited by an attacker to perform man-in-the-middle attacks, potentially allowing the attacker to obtain sensitive information from the affected system. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact but low integrity and no availability impact.

Successful exploitation of this vulnerability could allow an attacker to intercept and obtain sensitive information from the administrative client communications of IBM WebSphere Application Server - Liberty. The impact is primarily confidentiality loss. There is no indication of integrity or availability compromise beyond limited impact stated.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the administrative client and using additional network-layer protections to reduce exposure to man-in-the-middle attacks.