{"id":"CVE-2026-78636","kind":"vulnerability","aliases":["CVE-2026-78636"],"related":[],"title":"IBM WebSphere Liberty: JMX REST connector leaks information through unsafe reflection","description":"IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 expose information because the JMX REST connector body parser uses unsafe class reflection. An attacker who can reach the connector can read data the server should keep hidden.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jmx","liberty","runtime","websphere"],"not_affected_if":["jmx-rest-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T19:17:40+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","triaged_at":"2026-11-08T19:23:26+00:00","updated_at":"2026-11-08T19:23:26+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-08T19:23:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM WebSphere Liberty: JMX REST connector leaks information through unsafe reflection","impact":"low","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 expose information because the JMX REST connector body parser uses unsafe class reflection. An attacker who can reach the connector can read data the server should keep hidden.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["websphere","liberty","java","jmx"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads server information it should not see","analyst_note":"Confirm whether the JMX REST connector is on by default, whether authentication is required, and the fixed IBM Liberty version from the IBM security bulletin.","how_to_check":"- Check the installed Liberty version with `productInfo version` in the Liberty install directory, unknown otherwise.\n- Check whether the JMX REST connector feature (`restConnector-2.0`) is enabled in `server.xml`, unknown otherwise.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["jmx-rest-disabled"],"who_is_affected":"Teams running IBM WebSphere Application Server Liberty in the affected range that expose the JMX REST connector. Servers without the JMX REST connector enabled are likely not reachable through this path, but the sources do not confirm this. The sources do not say whether authentication is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4535,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-78636':14A,17A '17.0.0.3':29B,65C '26.0.0.10':31B,67C 'affect':69C 'applic':25B,62C 'attack':46B 'bodi':39B,85C 'class':43B,78C 'connector':6A,38B,51B,84C 'cve':12A,15A 'data':54B 'disclosur':73C 'due':75C 'expos':32B 'hidden':59B 'ibm':1A,23B,60C 'inform':8A,33B,72C 'java':18B 'jmx':4A,19B,36B,82C 'keep':58B 'leak':7A 'liberti':3A,20B,27B,64C 'parser':40B,86C 'reach':49B 'read':53B 'reflect':11A,44B,79C 'rest':5A,37B,83C 'runtim':21B 'server':26B,56B,63C 'unsaf':10A,42B,77C 'use':41B 'version':28B 'vulner':74C 'webspher':2A,22B,24B,61C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM WebSphere Application Server Liberty in the affected range that expose the JMX REST connector. Servers without the JMX REST connector enabled are likely not reachable through this path, but the sources do not confirm this. The sources do not say whether authentication is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","jmx","liberty","medium","runtime","websphere"],"campaign_type":null,"search_a":"'-2026':13A,16A '-78636':14A,17A 'connector':6A 'cve':12A,15A 'ibm':1A 'inform':8A 'jmx':4A 'leak':7A 'liberti':3A 'reflect':11A 'rest':5A 'unsaf':10A 'webspher':2A","search_b":"'17.0.0.3':29B '26.0.0.10':31B 'applic':25B 'attack':46B 'bodi':39B 'class':43B 'connector':38B,51B 'data':54B 'expos':32B 'hidden':59B 'ibm':23B 'inform':33B 'java':18B 'jmx':19B,36B 'keep':58B 'liberti':20B,27B 'parser':40B 'reach':49B 'read':53B 'reflect':44B 'rest':37B 'runtim':21B 'server':26B,56B 'unsaf':42B 'use':41B 'version':28B 'webspher':22B,24B","search_c":"'17.0.0.3':65C '26.0.0.10':67C 'affect':69C 'applic':62C 'bodi':85C 'class':78C 'connector':84C 'disclosur':73C 'due':75C 'ibm':60C 'inform':72C 'jmx':82C 'liberti':64C 'parser':86C 'reflect':79C 'rest':83C 'server':63C 'unsaf':77C 'vulner':74C 'webspher':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78636","severity":null,"published_at":"2026-11-08T19:17:40+00:00","modified_at":"2026-11-08T19:17:40+00:00","first_seen_at":"2026-11-08T19:22:34+00:00","fetched_at":"2026-11-08T19:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}