CVE-2026-3621: IBM WebSphere Application Server Liberty is affected by identity spoofing
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.5Patch PH70352 - Configuration
Enable the appSecurity feature on the Liberty server (appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0, or appSecurity-5.0) so the application is not deployed without authentication/authorization; this is required because identity spoofing occurs only when appSecurity is not enabled.
IBM WebSphere Application Server Liberty appSecurity feature (appSecurity-1.0 through appSecurity-5.0) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3621?
CVE-2026-3621 is categorized as a moderate severity vulnerability affecting IBM WebSphere Application Server Liberty.
How do I fix CVE-2026-3621?
To mitigate CVE-2026-3621, ensure that authentication is properly configured for applications deployed within the affected IBM WebSphere Application Server Liberty versions.
Which versions of IBM WebSphere Application Server Liberty are affected by CVE-2026-3621?
CVE-2026-3621 affects IBM WebSphere Application Server Liberty versions from 17.0.0.3 through 26.0.0.4.
What type of vulnerability is CVE-2026-3621 classified as?
CVE-2026-3621 is classified as an identity spoofing vulnerability.
What conditions allow CVE-2026-3621 to be exploited?
CVE-2026-3621 can be exploited when applications are deployed without proper authentication configured.