Ibm WebSphere Application Server - Liberty vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ibm WebSphere Application Server - Liberty: 47 record(s), with affected versions and fixes.
CVE-2026-95696
Medium · 6.5
CWE-400 Oct 13, 2026
IBM WebSphere Application Server Liberty Denial of Service
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695
High · 7.4
CWE-863 Oct 13, 2026
IBM WebSphere Application Server Liberty Incorrect Authorization
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909
Critical · 9.1
CWE-384 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905
High · 8.2
CWE-502 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895
Critical · 9.1
CWE-284 Oct 13, 2026
IBM WebSphere Application Server Liberty Improper Access Control
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-79715
Medium · 5.5
CWE-22 Oct 13, 2026
IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
CVE-2026-77816
Medium · 6.5
CWE-295 Oct 13, 2026
IBM WebSphere Application Server Liberty Improper Certificate Validation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVE-2026-14909
Medium · 6.5
CWE-209 Oct 13, 2026
IBM WebSphere Application Server Liberty Information Disclosure
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
CVE-2026-14532
Medium · 4.3
CWE-190 Oct 13, 2026
IBM WebSphere Application Server Liberty Integer Overflow
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
CVE-2026-11713
Medium · 5.4
CWE-863 Oct 13, 2026
IBM WebSphere Application Server Liberty Incorrect Authorization
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-105443
High · 8.2
CWE-284 Oct 13, 2026
IBM WebSphere Application Server Liberty is affected by an improper access control
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-105442
High · 7.5
CWE-502 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-101294
High · 8.7
CWE-325 Oct 13, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVE-2026-103499
High · 7.5
CWE-400 Oct 13, 2026
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere...
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-14525
Critical · 9.4
CWE-306 Aug 13, 2026
IBM WebSphere Application Server Liberty is affected by an authenication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
CVE-2026-10571
Medium · 5.3
CWE-502 Aug 13, 2026
IBM WebSphere Application Server Liberty is affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
CVE-2026-18499
High · 8.1
CWE-285 Aug 12, 2026
IBM WebSphere Application Server Liberty is affected by a privilege escalation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400
Critical · 9.8
CWE-470 Aug 5, 2026
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
CVE-2026-9322
High · 7.5
CWE-400 Jul 30, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
CVE-2026-10842
High · 7.5
CWE-289 Jul 30, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
CVE-2026-14980
High · 8.8
CWE-269 Jul 30, 2026
IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
CVE-2026-11897
High · 7.5
CWE-770 Jul 30, 2026
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-2482
High · 8.8
CWE-352 Jul 29, 2026
IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2026-14529
Critical · 9.8
CWE-306 Jul 29, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
CVE-2026-15328
High · 8.1
CWE-444 Jul 28, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.