The vulnerability is a privilege escalation flaw that allows an attacker to gain elevated rights within an IBM WebSphere Application Server Liberty environment when the restConnector‑2.0 feature is enabled. Exploiting this weakness could enable access to protected resources or functionalities that should be restricted to lower‑privileged users, potentially compromising confidentiality, integrity, or availability of applications running under the Liberty profile.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected. The problem specifically impacts installations that have the restConnector‑2.0 feature enabled.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers would target a Liberty instance with restConnector‑2.0 enabled, likely sending crafted REST requests from a network location that can reach the server; however, the exact attack vector is not explicitly detailed in the advisory. Due to the moderate CVSS score and low EPSS value, monitoring and rapid patching are prudent measures.