CVE-2026-77816: IBM WebSphere Application Server Liberty Improper Certificate Validation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
Other sources
IBM WebSphere Application Server Liberty administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected component is the IBM WebSphere Application Server Liberty administrative client in versions 17.0.0.3 through 26.0.0.9. The provided information does not indicate that Liberty server runtime traffic or other clients are affected.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to perform a man-in-the-middle attack against the administrative client's communications. No privileges or user interaction are required according to the supplied CVSS vector, but exploitation has high attack complexity.
What is the likely impact of successful exploitation?
A successful man-in-the-middle attack could expose sensitive information handled by the administrative client. The supplied CVSS vector indicates high confidentiality impact, low integrity impact, and no availability impact.