IBM WebSphere Application Server 9.0, 8.5 and the WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 suffer a server‑side request forgery flaw when the sipServlet‑1.1 feature is enabled. The vulnerability comes from missing authentication checks (CWE‑306) that allow an attacker to craft SIP requests that the server forwards to internal or external resources. If successfully exploited, the attacker could access sensitive internal systems, exfiltrate data or reach protected services. The flaw may also serve as a stepping‑stone for further attacks within the internal network.

Affected systems include IBM WebSphere Application Server 9.0, IBM WebSphere Application Server 8.5, and IBM WebSphere Application Server Liberty from version 17.0.0.3 up to 26.0.0.8. The flaw only applies when the sipServlet‑1.1 feature is enabled. Exact impacted version ranges are 9.0.0.0‑9.0.5.28 for traditional servers, 8.5.0.0‑8.5.5.30 for older traditional servers, and Liberty 17.0.0.3‑26.0.0.8.

The CVSS score of 9.4 classifies this flaw as critical, with an EPSS score of less than 1% indicating a low probability of widespread exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, but its high severity and potential to expose internal resources make it a priority. Attackers would need to reach the vulnerable server and supply a crafted SIP request; the missing authentication check allows the server to forward the request to arbitrary hosts. If the target host performs actions that impact the server’s state, the attacker could potentially expand the attack surface within the internal network.