IBM WebSphere Application Server Liberty versions 17.0.0.3 to 26.0.0.10 suffer from an improper access control flaw caused by insufficient isolation between servers sharing a single installation. This weakness, identified as CWE‑284, allows an attacker who can reach a Liberty instance to gain unauthorized access to data or functionality that should be confined to that server alone. The result is a potentially full compromise of the affected server and the applications it hosts.

The vulnerability affects IBM WebSphere Application Server Liberty products from version 17.0.0.3 through 26.0.0.10, inclusive. Both the 17.x and 26.x lineages are impacted, with any instance running the restConnector‑1.0 or restConnector‑2.0 feature likely exposed to the risk.

The CVSS score of 8.2 indicates high severity, and the EPSS score of less than 1% suggests a low probability of observed exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known production exploitation yet. No explicit remote attack vector is described in the documentation; the attack likely requires the attacker to be able to interact with the Liberty installation, either locally or through other components that expose the affected servers. Because the flaw stems from shared installation boundaries rather than an internet-facing component, the direct attack surface may be limited, but once the attacker reaches the server environment the impact is significant.