The vulnerability in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.9 allows an authenticated attacker to access sensitive information when the restConnector-2.0 component is enabled. This is a classic information disclosure flaw (CWE‑209), exposing confidential data that should be protected. The disclosure impacts confidentiality only, with no denial of service or code execution.

Affected products are IBM WebSphere Application Server Liberty versions 17.0.0.3 to 26.0.0.9. The vulnerability is present in the release line highlighted by IBM and is mitigated by applying the 26.0.0.10 or later fix pack. Administrators should verify that their installations fall within the affected range.

The CVSS base score of 6.5 represents moderate severity, while the EPSS score of less than 1% indicates a low likelihood of active exploitation. The flaw requires an attacker to authenticate to the server, so the impact is limited to users who can log in. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is likely local or remote with authentication.