Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T17:17:25.650Z",
  "pubdate": "2026-08-12T17:17:25.650Z",
  "executiveSummary": "A privilege escalation vulnerability affects IBM WebSphere Application Server - Liberty when utilizing Liberty collectives. The vulnerability allows unauthorized users to escalate their privilege levels within the affected system. The impacted product is IBM WebSphere Application Server - Liberty spanning versions 17.0.0.3 through 26.0.0.8.\nThe risk implications are significant, as successful exploitation enables threat actors with lower-privileged access to assume higher privileges across the collective architecture. This breaks the security boundary enforced by role-based access controls within the management topology.\nAttacker capabilities depend on interacting with the Liberty collective mechanism. Exploitation requirements involve targeting environments configured with Liberty collectives, specifically leveraging the trust relationships and communication channels established between collective controllers and collective members. No explicit out-of-band requirements are stated beyond the inherent architecture of the vulnerable component.",
  "technicalDetails": "The root cause of the vulnerability resides within the authorization and trust validation logic of Liberty collectives in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8. When managing distributed instances via a collective controller and collective members, inadequate validation of administrative requests or insufficient cryptographic verification of internal control messages permits privilege boundaries to be bypassed.\nThe vulnerable component is the Liberty collective management framework responsible for inter-server communication, administrative command propagation, and cluster synchronization. The attack vector relies on manipulating the protocol interactions or message payloads exchanged within the collective infrastructure.\nThe attack flow proceeds as follows: First, an authenticated user or an entity interacting with the Liberty collective identifies an insufficiency in how requests are authorized by the collective controller or member nodes. Second, the attacker crafts a malicious sequence of control messages or requests designed to mimic higher-privileged administrative actions. Third, due to the flawed validation mechanism, the collective accepts the command without properly enforcing the required privilege level. Finally, the system executes the command, granting the attacker elevated administrative capabilities over the affected collective components.\nAuthentication requirements vary depending on collective configuration, but the attack typically presupposes network exposure to the collective management ports and a baseline level of interaction capability within the domain. The post-exploitation impact includes full administrative control over affected collective nodes, potential lateral movement across the application server domain, unauthorized configuration modifications, and compromise of deployed applications."
}