Ibm Websphere Application Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ibm Websphere Application Server: 89 record(s), with affected versions and fixes.cpe:2.3:a:ibm:websphere_application_server
CVE-2026-14515
Medium · 6.1
CWE-79 Jul 28, 2026
IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.
CVE-2026-14512
Critical · 9.8
CWE-502 Jul 28, 2026
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
CVE-2026-14446
Critical · 9.8
CWE-306 Jul 28, 2026
IBM WebSphere Application Server is affected by a privilege escalation
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
CVE-2026-16192
Medium · 6.5
CWE-674 Jul 28, 2026
IBM WebSphere Application Server Liberty is affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
CVE-2026-16184
Critical · 9.8
CWE-862 Jul 28, 2026
IBM WebSphere Application Server is affected by an authentication bypass
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.
CVE-2026-11541
Critical · 9.8
CWE-444 Jun 30, 2026
IBM WebSphere Application Server and Liberty HTTP Request Smuggling (CVE-2026-11541)
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
CVE-2026-11594
Medium · 6.1
CWE-79 Jun 30, 2026
IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
CVE-2026-11806
High · 7.5
CWE-444 Jun 30, 2026
IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-11714
Critical · 9.8
CWE-918 Jun 30, 2026
IBM WebSphere Application Server Liberty: SSRF in apiDiscovery-1.0
IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
CVE-2026-11712
Critical · 9.3
CWE-79 Jun 30, 2026
IBM WebSphere Application Server XSS in Administrative Console Help System
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.
CVE-2026-11708
Critical · 9.3
CWE-79 Jun 30, 2026
IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
CVE-2026-11595
High · 7.5
CWE-22 Jun 30, 2026
IBM WebSphere Application Server is affected by a Path Traversal vulnerability
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.
CVE-2026-11546
Critical · 9.8
CWE-918 Jun 30, 2026
IBM WebSphere Application Server Liberty SSRF (CVE-2026-11546)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
CVE-2026-10852
High · 7.5
CWE-476 Jun 22, 2026
Websphere Application Server is Affected By a Denial of Service
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.
CVE-2026-9320
High · 7.5
CWE-400 Jun 22, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9072
Critical · 9.8
CWE-94 Jun 22, 2026
IBM WebSphere WebServer Plug-in Code Injection and Denial of Service
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.
CVE-2026-9071
High · 7.5
CWE-400 Jun 22, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9006
Critical · 9.1
CWE-918 Jun 22, 2026
IBM WebSphere Application Server SSRF in Ajax Proxy
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.
CVE-2026-8858
High · 8.8
CWE-94 Jun 22, 2026
WebSphere Application Server Remote Code Execution
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.
CVE-2026-8646
Critical · 9.1
CWE-444 Jun 22, 2026
IBM WebSphere Application Server and Liberty HTTP Request Smuggling Vulnerability
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.
CVE-2026-10845
High · 7.3
CWE-287 Jun 22, 2026
IBM WebSphere Application Server is affected by an authentication bypass vulnerability
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.
CVE-2026-9330
High · 8.5
CWE-502 Jun 1, 2026
IBM WebSphere Application Server is affected by remote code execution
IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.
CVE-2026-9319
Critical · 9.0
CWE-502 Jun 1, 2026
IBM WebSphere Application Server is affected by a remote code execution vulnerability
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.
CVE-2026-9311
Critical · 9.0
CWE-94 Jun 1, 2026
IBM WebSphere Application Server is affected by remote code execution
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
CVE-2026-8644
Critical · 9.1
CWE-290 Jun 1, 2026
IBM WebSphere Application Server is affected by an identity spoofing vulnerability
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.