CVE-2026-101294: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
Other sources
WebSphere Application Server - Liberty could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Serverto a version that resolves this vulnerability.Fixed in 8.5.5.32 - Upgrade
Upgrade
IBM WebSphere Application Serverto a version that resolves this vulnerability.Fixed in 9.0.5.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DT503882 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DT502997
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review IBM WebSphere Application Server 8.5 and 9.0 deployments, along with WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10. The provided information does not identify unaffected maintenance levels for the 8.5 or 9.0 product lines.
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable without privileges or user interaction, although exploitation has high attack complexity.
What is the likely security impact if exploitation succeeds?
Successful exploitation can bypass cryptographic signature verification and has high confidentiality and integrity impact. No availability impact is indicated.