IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.3) can be configured to use the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0, or appSecurity-5.0 security features, but when these features are enabled the product may not enforce security settings as strongly as expected. In plain terms, an attacker with local access may be able to take advantage of weaker-than-intended security controls related to how Liberty administers security configuration.
The issue is tracked as CWE-1393 (Use of Default Password). The IBM advisory states that Liberty “could provide weaker than expected security when administering security settings” when one of the appSecurity-* features is enabled. The attack vector is listed as LOCAL and the CVSS indicates the attacker requires higher privileges (PR:H) but no user interaction (UI:N). While the reference content does not include specific code paths or a detailed exploitation sequence, the CWE mapping and the theme of “administering security settings” strongly suggest the weakness is tied to how security credentials/settings are handled during administration—potentially resulting in default/insufficiently protected authentication material or security configuration.
Impact: With CVSS 6.7 (Medium) and vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, a successful attacker could potentially achieve high-impact outcomes across confidentiality, integrity, and availability (C:H/I:H/A:H). Because the attack vector is LOCAL and privileges required are high (PR:H), exploitation is not expected to be remote or trivial; however, if an attacker can influence or access the administration context on the host, the “weaker than expected security” condition could enable compromise of protected resources and services. Real-world risk is therefore most relevant to environments where local attackers (or compromised local accounts) can interact with Liberty administration and where the appSecurity-* features are enabled.
Mitigation: IBM strongly recommends remediating by applying an interim fix or fix pack that contains the fix for APAR PH70078. The advisory also notes that after installing the interim fix/fixpack, additional post-install instructions must be followed as provided in the interim fix link.
For Liberty 17.0.0.3 – 26.0.0.3 using appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0, or appSecurity-5.0:
- Upgrade to the minimal fix pack levels required by the interim fix, then apply the Interim Fix that resolves PH70078, and carefully follow the post-install steps.
- Alternatively, apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026).
Detection guidance from the provided content is limited; IBM advises using the referenced “How to determine if Liberty is using a specific feature” page to confirm whether the relevant appSecurity-* feature is enabled, then ensure the PH70078 fix (or the 26.0.0.4+ fix pack path) is applied.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-1393