CVE-2026-95695: IBM WebSphere Application Server Liberty Incorrect Authorization
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
Other sources
WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions due to incorrect authorization.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.11Patch DT502929
Event History
Frequently Asked Questions
Which Liberty versions are affected?
IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 are identified as affected.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates that exploitation does not require privileges or user interaction, although attack complexity is high.
What security impact can a successful attacker have?
A remote attacker may bypass security restrictions. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.