CVE-2026-10844: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Q: Which Liberty versions are affected?

The affected range is IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10. Versions prior to 26.0.0.11 are identified as affected in the provided information.

Q: What does an attacker need to exploit this issue?

The issue can be exploited remotely with low attack complexity and requires no attacker privileges. It requires user interaction, consistent with a phishing attack scenario.

Q: What is the expected security impact?

The provided severity vector indicates low integrity impact, with no stated confidentiality or availability impact. The issue is rated medium severity with a score of 4.3.

Published Nov 3, 2026

Updated

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.

Other sources

IBM WebSphere Application Server Liberty could allow a remote attacker to conduct phishing attacks.

— IBM

Affected Software

1 affected component

IBM WebSphere Application Server - Liberty<=17.0.0.3 - 26.0.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM WebSphere Application Server Liberty to a version that resolves this vulnerability.
Fixed in 26.0.0.11

Event History

Nov 3, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·04:56 PM

Data Sourced

via MITRE·04:56 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295268

Frequently Asked Questions

Which Liberty versions are affected?

The affected range is IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10. Versions prior to 26.0.0.11 are identified as affected in the provided information.

What does an attacker need to exploit this issue?

The issue can be exploited remotely with low attack complexity and requires no attacker privileges. It requires user interaction, consistent with a phishing attack scenario.

What is the expected security impact?

The provided severity vector indicates low integrity impact, with no stated confidentiality or availability impact. The issue is rated medium severity with a score of 4.3.

CVE-2026-10844: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which Liberty versions are affected?

What does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which Liberty versions are affected?

What does an attacker need to exploit this issue?

What is the expected security impact?