CVE-2026-78636: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Q: Which Liberty versions are affected?

The affected range is IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10. Versions prior to 17.0.0.3 are not identified as affected in the provided data.

Q: What access does an attacker need to exploit this issue?

The severity vector indicates network reachability, low attack complexity, no user interaction, and low privileges required. This means an attacker needs an account or other low-level authenticated access capable of reaching the JMX REST connector.

Q: What impact is indicated by the severity data?

The provided vector indicates low confidentiality impact and no integrity or availability impact. The described issue is an information disclosure vulnerability in the JMX REST connector body parser.

Published Nov 3, 2026

Updated

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

Other sources

IBM WebSphere Application Server Liberty is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

— IBM

Affected Software

1 affected component

IBM WebSphere Application Server - Liberty<=17.0.0.3 - 26.0.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM WebSphere Application Server Liberty to a version that resolves this vulnerability.
Fixed in 26.0.0.11

Event History

Nov 3, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:40 PM

Data Sourced

via MITRE·06:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295268

Frequently Asked Questions

Which Liberty versions are affected?

The affected range is IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10. Versions prior to 17.0.0.3 are not identified as affected in the provided data.

What access does an attacker need to exploit this issue?

The severity vector indicates network reachability, low attack complexity, no user interaction, and low privileges required. This means an attacker needs an account or other low-level authenticated access capable of reaching the JMX REST connector.

What impact is indicated by the severity data?

The provided vector indicates low confidentiality impact and no integrity or availability impact. The described issue is an information disclosure vulnerability in the JMX REST connector body parser.

CVE-2026-78636: IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which Liberty versions are affected?

What access does an attacker need to exploit this issue?

What impact is indicated by the severity data?

Company

Resources

Contact

Frequently Asked Questions

Which Liberty versions are affected?

What access does an attacker need to exploit this issue?

What impact is indicated by the severity data?