CVE-2026-103320: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
Other sources
IBM WebSphere Application Server Liberty could allow an authenticated user with the Reader role to obtain sensitive information.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11
Event History
Frequently Asked Questions
Which Liberty deployments are affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected. Versions prior to 26.0.0.11 are identified as affected in the available data.
What access does an attacker need?
An attacker must already be authenticated and have the Reader role. The issue is remotely exploitable with low attack complexity and does not require user interaction.
What is the impact of successful exploitation?
A user with the Reader role could obtain sensitive information. The provided severity vector indicates low confidentiality impact, with no integrity or availability impact.