Ibm Websphere Application Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ibm Websphere Application Server: 66 record(s), with affected versions and fixes.cpe:2.3:a:ibm:websphere_application_server
CVE-2026-105442
High · 7.5
CWE-502 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-101294
High · 8.7
CWE-325 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVE-2026-95680
High · 8.0
CWE-287 Oct 13, 2026
IBM WebSphere Application Server is affected by an authorization bypass
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
CVE-2026-93907
High · 8.1
CWE-287 Oct 13, 2026
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass...
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
CVE-2026-103499
High · 7.5
CWE-400 Oct 13, 2026
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-14525
Critical · 9.4
CWE-306 Aug 13, 2026
Missing Authentication for Critical Function in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
CVE-2026-10571
Medium · 5.3
CWE-502 Aug 13, 2026
Deserialization of Untrusted Data in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
CVE-2026-18499
High · 8.1
CWE-285 Aug 12, 2026
Improper Authorization in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400
Critical · 9.8
CWE-470 Aug 5, 2026
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server -…
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
CVE-2026-11536
High · 8.5
CWE-502 Jul 30, 2026
Deserialization of Untrusted Data in Ibm Websphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
CVE-2026-9322
High · 7.5
CWE-400 Jul 30, 2026
Uncontrolled Resource Consumption in Ibm Websphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
CVE-2026-10842
High · 7.5
CWE-289 Jul 30, 2026
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server -…
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
CVE-2026-14980
High · 8.8
CWE-269 Jul 30, 2026
Improper Privilege Management in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
CVE-2026-11897
High · 7.5
CWE-770 Jul 30, 2026
Allocation of Resources Without Limits or Throttling in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-11707
Critical · 9.3
CWE-79 Jul 30, 2026
Cross-site Scripting (XSS) in Ibm Websphere Application Server
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
CVE-2026-11383
Medium · 5.4
CWE-79 Jul 30, 2026
Cross-site Scripting (XSS) in Ibm Websphere Application Server
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
CVE-2026-2482
High · 8.8
CWE-352 Jul 29, 2026
Cross-Site Request Forgery (CSRF) in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2026-14529
Critical · 9.8
CWE-306 Jul 29, 2026
Missing Authentication for Critical Function in Ibm Websphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
CVE-2026-15328
High · 8.1
CWE-444 Jul 28, 2026
HTTP Request Smuggling in Ibm Websphere Application Server
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.
CVE-2026-15325
High · 8.7
CWE-444 Jul 28, 2026
HTTP Request Smuggling in Ibm Websphere Application Server
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
CVE-2026-15280
High · 7.5
CWE-22 Jul 28, 2026
Path Traversal in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
CVE-2026-15064
High · 8.7
CWE-444 Jul 28, 2026
HTTP Request Smuggling in Ibm Websphere Application Server
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-15057
High · 7.5
CWE-787 Jul 28, 2026
Out-of-bounds Write in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
CVE-2026-14981
High · 7.5
CWE-400 Jul 28, 2026
Uncontrolled Resource Consumption in Ibm Websphere Application Server
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-14976
Critical · 9.8
CWE-306 Jul 28, 2026
Missing Authentication for Critical Function in Ibm Websphere Application Server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.