WebSphere Application Server vulnerabilities

72 known vulnerabilities in WebSphere Application Server from IBM. 72 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

72vulnerabilities

24critical

48high

1exploited

8.3average CVSS score

Latest first

7.5 High severity
WebSphere Application Server - Liberty: Uncontrolled Resource Consumption
CVE-2026-95696Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
9.1 Critical severity
WebSphere Application Server - Liberty: Incorrect Authorization
CVE-2026-95695Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
9.1 Critical severity
WebSphere Application Server - Liberty: Session Fixation
CVE-2026-93909Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
8.2 High severity
WebSphere Application Server - Liberty: Deserialization of Untrusted Data
CVE-2026-93905Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
9.1 Critical severity
WebSphere Application Server - Liberty: Improper Access Control
CVE-2026-93895Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
7.5 High severity
WebSphere Application Server: Deserialization of Untrusted Data
CVE-2026-105442Oct 13, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
8.7 High severity
WebSphere Application Server - Liberty: Missing Cryptographic Step
CVE-2026-101294Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
8.0 High severity
WebSphere Application Server: Improper Authentication
CVE-2026-95680Oct 13, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
8.1 High severity
WebSphere Application Server: Improper Authentication
CVE-2026-93907Oct 13, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
7.5 High severity
WebSphere Application Server - Liberty: Uncontrolled Resource Consumption
CVE-2026-103499Oct 13, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
8.1 High severity
WebSphere Application Server: Improper Privilege Management
CVE-2026-9327Sep 10, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.
7.1 High severity
WebSphere Application Server: Improper Control of Generation of Code
CVE-2026-9176Sep 10, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.
7.5 High severity
WebSphere Application Server: Missing Authentication for Critical Functionality
CVE-2026-9336Sep 10, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem s
9.4 Critical severity
WebSphere Application Server - Liberty: Missing Authentication for Critical Functionality
CVE-2026-14525Aug 13, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
9.8 Critical severity
WebSphere Application Server: Use of Externally-Controlled Input to Select Classes or Code
CVE-2026-8400Aug 5, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitr
7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
CVE-2026-9322Jul 30, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
7.5 High severity
WebSphere Application Server: Authentication Bypass by Alternate Name
CVE-2026-10842Jul 30, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
8.8 High severity
WebSphere Application Server - Liberty: Improper Privilege Management
CVE-2026-14980Jul 30, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
7.5 High severity
WebSphere Application Server - Liberty: Allocation of Resources Without Limits or Throttling
CVE-2026-11897Jul 30, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
9.3 Critical severity
Tivoli System Automation Application Manager: Improper Neutralization of Input During Web Page Generation
CVE-2026-11707Jul 30, 2026IBM
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
8.8 High severity
WebSphere Application Server - Liberty: Cross-Site Request Forgery
CVE-2026-2482Jul 29, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
9.8 Critical severity
WebSphere Application Server: Missing Authentication for Critical Functionality
CVE-2026-14529Jul 29, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
8.7 High severity
WebSphere Application Server: Inconsistent Interpretation of HTTP Requests
CVE-2026-15325Jul 28, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
7.5 High severity
WebSphere Application Server - Liberty: Improper Limitation of a Pathname to a Restricted Directory
CVE-2026-15280Jul 28, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
8.7 High severity
WebSphere Application Server: Inconsistent Interpretation of HTTP Requests
CVE-2026-15064Jul 28, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
CVE-2026-14981Jul 28, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
9.8 Critical severity
WebSphere Application Server - Liberty: Missing Authentication for Critical Functionality
CVE-2026-14976Jul 28, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
9.8 Critical severity
WebSphere Application Server: Deserialization of Untrusted Data
CVE-2026-14974Jul 28, 2026IBM
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
9.8 Critical severity
WebSphere Application Server: Deserialization of Untrusted Data
CVE-2026-14512Jul 28, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
9.8 Critical severity
CICS Transaction Gateway for Multiplatforms: Inconsistent Interpretation of HTTP Requests
CVE-2026-11541Jun 30, 2026IBM
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
7.5 High severity
WebSphere Application Server - Liberty: Inconsistent Interpretation of HTTP Requests
CVE-2026-11806Jun 30, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
9.3 Critical severity
WebSphere Application Server: Improper Neutralization of Input During Web Page Generation
CVE-2026-11708Jun 30, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
7.5 High severity
WebSphere Application Server: Improper Limitation of a Pathname to a Restricted Directory
CVE-2026-11595Jun 30, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.
9.8 Critical severity
WebSphere Application Server - Liberty: Server-Side Request Forgery
CVE-2026-11546Jun 30, 2026IBM
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
7.5 High severity
WebSphere Application Server: NULL Pointer Dereference
CVE-2026-10852Jun 22, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.
7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
CVE-2026-9320Jun 22, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to c
9.8 Critical severity
WebSphere Application Server: Improper Control of Generation of Code
CVE-2026-9072Jun 22, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploite
7.5 High severity
WebSphere Application Server: Uncontrolled Resource Consumption
CVE-2026-9071Jun 22, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to c
9.1 Critical severity
WebSphere Application Server: Server-Side Request Forgery
CVE-2026-9006Jun 22, 2026IBM
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure
8.8 High severity
WebSphere Application Server: Improper Control of Generation of Code
CVE-2026-8858Jun 22, 2026IBM
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the app