CVE-2026-15280 is a path-segment injection vulnerability affecting the ND Collective Controller component of IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8. The vulnerability arises from improper handling of path segments in the collective routing mechanism, potentially allowing an attacker to influence routing behavior. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the vulnerability can be exploited remotely without authentication or user interaction, resulting in a high confidentiality impact. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to inject path segments in the collective routing mechanism, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). There is no impact on integrity or availability reported. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor IBM's security advisories for updates. Until a fix is available, consider restricting network access to the ND Collective Controller component to trusted sources if possible.