Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

IBM WebSphere Application Server - LibertyIBM WebSphere Application Server Liberty is affected by a privilege escalation

Risk 60
Severity
8.1
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-18499

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Risk 31
Severity
7.5
EPSS
0.30%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

First published (updated )
CVE-2026-9322

IBM WebSphere Application Server - LibertyIBM WebSphere Application Server Liberty is affected by a denial of service

Risk 48
Severity
7.1
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

First published (updated )
CVE-2026-16192

IBM WebSphere Application Server 9.0IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Risk 64
Severity
8.7
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-15064

IBM WebSphere Application Server 9.0IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-14981

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Risk 64
Severity
8.7
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

First published (updated )
CVE-2026-15325

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests

Risk 75
Severity
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-15328

IBM WebSphere Application Server - LibertyIBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

Risk 43
Severity
7.5
Path Traversal
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-15280

IBM WebSphere Application Server 9.0IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

Risk 43
Severity
7.5
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-14528

IBM WebSphere Application Server - LibertyIBM WebSphere Application Server Liberty is affected by a cross-site request forgery

Risk 77
Severity
8.8
CSRF
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-2482

IBM WebSphere Application Server - LibertyIBM WebSphere Application Server Liberty is affected by a cross-site request forgery

Risk 77
Severity
8.8
SSRF
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

First published (updated )
CVE-2026-14980

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-15057

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11897

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-10842

IBM WebSphere Application ServerIBM WebSphere Application Server is affected by a Path Traversal vulnerability

Risk 43
Severity
7.5
Path Traversal
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11595

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11806

IBM WebSphere Application ServerIBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities

Risk 61
Severity
8.5
XSS
AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11594

IBM WebSphere Application Server 9.0IBM WebSphere Application Server is affected by a remote code execution vulnerability

Risk 73
Severity
8.5
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11536

IBM WebSphere Application ServerIBM WebSphere Application Server is affected by an authentication bypass vulnerability

Risk 51
Severity
7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

First published (updated )
CVE-2026-10845

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption

Risk 31
Severity
7.5
EPSS
0.55%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-9071

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Risk 31
Severity
7.5
EPSS
0.56%
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-9320

IBM WebSphere Application ServerIBM WebSphere Application Server is affected by remote code execution

Risk 54
Severity
8.5
EPSS
0.52%
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-9330

IBM WebSphere Application ServerIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service

Risk 43
Severity
7.5
AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

First published (updated )
CVE-2026-4410

IBM Web Server Plug-insIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins

Risk 37
Severity
7.5
EPSS
0.28%
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-8620

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty is affected by identity spoofing

Risk 70
Severity
7.5
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-3621

IBM WebSphere Application ServerIBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability

Risk 66
Severity
7.2
Infoleak
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.

1 / 2
Source: MITRE
First published (updated )
CVE-2025-14915

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty Path Traversal

Risk 60
Severity
7.6
Path Traversal
AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

Remedy

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH69485. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.1 using the restConnector-1.0 or restConnector-2.0 feature(s): · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH69485 https://www.ibm.com/support/pages/node/7257603 --OR-- · Apply Liberty Fix Pack 26.0.0.2 or later (targeted availability 1Q2026). Additional interim fixes may be available and linked off the interim fix download page.
First published (updated )
CVE-2025-14914

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty denial of service

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

First published (updated )
CVE-2025-36047

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty bypass security

Risk 43
Severity
7.5
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration

1 / 2
Source: MITRE
First published (updated )
CVE-2025-36124

IBM WebSphere Application ServerIBM WebSphere Application Server information disclosure

Risk 43
Severity
7.5
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.

1 / 2
Source: MITRE
First published (updated )
CVE-2024-56339

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203