CVE-2026-93895: IBM WebSphere Application Server Liberty Improper Access Control
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
Other sources
WebSphere Application Server Liberty could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Patch DT502929
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 are affected when they use gRPC service methods with configured access controls.
Does exploitation require an authenticated account or user interaction?
No. The vulnerability is remotely exploitable by an unauthenticated attacker and requires no user interaction.
What is the security impact of a successful exploit?
An attacker could bypass access controls configured on gRPC service methods. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact stated.