CVE-2026-108284: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
Other sources
IBM WebSphere Application Server Liberty could allow an authenticated user with the Reader role to obtain sensitive information.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11
Event History
Frequently Asked Questions
Which deployments are affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are identified as affected. Versions prior to 26.0.0.11 are also described as affected.
What level of access does an attacker need?
An attacker must already be authenticated and have the Reader role. No user interaction is required.
What is the potential impact?
A Reader-role user could obtain sensitive information. The provided severity vector indicates confidentiality impact is high, while integrity and availability impact are not indicated.