CVE-2026-105443: IBM WebSphere Application Server Liberty is affected by an improper access control
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
Other sources
IBM WebSphere Application Server Liberty has insufficient isolation between servers sharing an install.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT503659
Event History
Frequently Asked Questions
Which deployments are in scope?
The issue affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 when multiple servers share an installation. Deployments that do not share an install are not identified as affected by the provided information.
What access would an attacker need?
The CVSS vector indicates network reachability and low privileges are required. Exploitation has high attack complexity and does not require user interaction.
What is the potential impact if exploited?
The vulnerability can result in high confidentiality and integrity impact, with no availability impact indicated. The scope is marked as changed, meaning impacts may extend beyond the initially vulnerable security authority.