CVE-2026-93905: IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
Other sources
IBM WebSphere Application Server Liberty could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11Patch DT502467
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker could exploit it. The attack vector is network-based and requires no privileges or user interaction.
What is the practical impact?
An attacker could corrupt the persisted status of batch job instances. The supplied severity vector indicates integrity impact is high and availability impact is low, while no confidentiality impact is listed.
Which Liberty versions are identified as affected?
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are identified as affected.