The vulnerability is a cross‑site request forgery that allows an attacker to craft a request that the victim’s browser will submit to the IBM WebSphere Application Server Liberty with the victim’s credentials, potentially leading to unauthorized manipulation of application data or configuration. This weakness is classified as CWE‑352 and would let an attacker perform any action that the victim’s account is permitted to execute, risking confidentiality, integrity, or availability of the affected resources.

IBM WebSphere Application Server Liberty versions from 17.0.0.3 through 26.0.0.8 are affected when the collectiveController‑1.0 feature is enabled. The remediation is an interim fix for the affected products or a newer Liberty Fix Pack (26.0.0.9 or later). The vendor recommends first upgrading to the minimal required fix pack level before applying the interim fix PH71678, or you can simply deploy a later fix pack that contains the fix.

The CVSS base score is 3.1, indicating relatively low severity, and the EPSS score is less than 1 %, implying a very low probability of exploitation; this vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a web‑based forgery, requiring an authenticated user to visit a malicious site that sends a forged request to the vulnerable server. While the risk is modest, the potential for unauthorized activity warrants timely patching.