CVE-2026-10852: Websphere Application Server is Affected By a Denial of Service
IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.
Other sources
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere WebServer Plug-in (for IBM WebSphere Application Server / Liberty)to a version that resolves this vulnerability.Fixed in 8.5.5.30 - Upgrade
Upgrade
IBM WebSphere WebServer Plug-in (for IBM WebSphere Application Server / Liberty)to a version that resolves this vulnerability.Fixed in 9.0.5.28 - Upgrade
Upgrade
Web Server Plug-ins Interim Fix for APAR PH71376to a version that resolves this vulnerability.Patch PH71376
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10852?
The severity of CVE-2026-10852 is medium with a score of 5.9.
What systems are affected by CVE-2026-10852?
CVE-2026-10852 affects IBM i versions 7.6, 7.5, 7.4, and 7.3, as well as IBM WebSphere Application Server and IBM WebSphere Application Server Liberty.
How do I fix CVE-2026-10852?
To fix CVE-2026-10852, apply the latest patches and updates provided by IBM for your affected WebSphere Application Server installations.
What type of vulnerability is CVE-2026-10852?
CVE-2026-10852 is categorized as a Denial of Service vulnerability.
How can CVE-2026-10852 be exploited?
CVE-2026-10852 can be exploited by attackers sending crafted requests to the web server, potentially leading to service disruption.