The vulnerability is present in the administrative client of IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9. The flaw allows an attacker to perform a man‑in‑the‑middle attack by interfering with TLS certificate validation, thereby intercepting administrative traffic and obtaining sensitive information. This weakness is classified as CWE-295.

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.9, installing the administrative client and connecting to the server over TLS.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is currently not listed in the CISA KEV catalog. Exploitation requires an attacker to intercept or spoof the TLS connection between the administrative client and the server, allowing the attacker to obtain sensitive administrative information.