WebSphere Application Server vulnerabilities

72 known vulnerabilities in WebSphere Application Server from IBM. 72 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  WebSphere Application Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-8646Jun 22, 2026IBM

  IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowi

• 7.3 High severity

  WebSphere Application Server: Improper Authentication

  CVE-2026-10845Jun 22, 2026IBM

  IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

• 8.5 High severity

  WebSphere Application Server: Deserialization of Untrusted Data

  CVE-2026-9330Jun 1, 2026IBM

  IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined wi

• 9.0 Critical severity

  WebSphere Application Server: Deserialization of Untrusted Data

  CVE-2026-9319Jun 1, 2026IBM

  IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

• 7.5 High severity

  WebSphere Application Server - Liberty: Uncontrolled Resource Consumption

  CVE-2026-4410May 27, 2026IBM

  IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attac

• 9.8 Critical severity

  Web Server Plug-ins for WebSphere Application…: Improper Control of Generation of Code

  CVE-2026-8633May 26, 2026IBM

  IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted re

• 7.5 High severity

  Web Server Plug-ins for WebSphere Application…: Inconsistent Interpretation of HTTP Requests

  CVE-2026-8620May 26, 2026IBM

  IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted re

• 9.8 Critical severity

  WebSphere Application Server - Liberty: Use of Default Password

  CVE-2025-14917Mar 25, 2026IBM

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.

• 7.2 High severity

  WebSphere Application Server - Liberty: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-14915Mar 25, 2026IBM

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.

• 9.8 Critical severity

  WebSphere Application Server - Liberty: Use of Hard-coded Credentials

  CVE-2025-14923Mar 3, 2026IBM

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.

• 7.6 High severity

  WebSphere Application Server Liberty: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-14914Feb 2, 2026IBM

  IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

• 7.5 High severity

  WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling

  CVE-2025-36047Aug 14, 2025IBM

  IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

• 7.5 High severity

  WebSphere Application Server Liberty: Privilege Chaining

  CVE-2025-36124Aug 12, 2025IBM

  IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration

• 7.5 High severity

  WebSphere Application Server: Trusting HTTP Permission Methods on the Server Side

  CVE-2024-56339Aug 7, 2025IBM

  IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.

• 7.5 High severity

  WebSphere Application Server: Stack-based Buffer Overflow

  CVE-2025-36097Jul 16, 2025IBM

  IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume e

• 9.8 Critical severity

  WebSphere Application Server: Deserialization of Untrusted Data

  CVE-2025-36038Jun 25, 2025IBMEPSS 13.3%

  IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

• 7.6 High severity

  WebSphere Application Server: Improper Neutralization of Input During Web Page Generation

  CVE-2025-33104May 14, 2025IBM

  IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a

• 7.5 High severity

  WebSphere Application Server: Improper Check for Unusual or Exceptional Conditions

  CVE-2024-45085Oct 15, 2024IBM

  IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service.

• 7.5 High severity

  WebSphere Application Liberty: Improper Certificate Validation

  CVE-2023-50314Aug 14, 2024IBM

  IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitiv

• 7.2 High severity

  WebSphere Application Server: Execution with Unnecessary Privileges

  CVE-2024-35154Jul 9, 2024IBMEPSS 1.16%

  IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execut

• 8.8 High severity

  WebSphere Application Server: Improper Verification of Cryptographic Signature

  CVE-2024-37532Jun 20, 2024IBM

  IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.

• 7.5 High severity

  WebSphere Application Server: Allocation of Resources Without Limits or Throttling

  CVE-2024-25026Apr 25, 2024IBM

  IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause t

• 7.0 High severity

  WebSphere Application Server: Improper Restriction of XML External Entity Reference

  CVE-2024-22354Apr 17, 2024IBM

  IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to exp

• 7.5 High severity

  WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling

  CVE-2024-27268Apr 4, 2024IBMEPSS 1.28%

  IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Fo

• 7.5 High severity

  WebSphere Application Server Liberty: Allocation of Resources Without Limits or Throttling

  CVE-2024-22353Mar 31, 2024IBM

  IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Fo

• 7.5 High severity

  WebSphere Application Server Liberty: Uncontrolled Resource Consumption

  CVE-2023-38737Aug 16, 2023IBMEPSS 1.02%

  IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-F

• 9.1 Critical severity

  WebSphere Application Server: Improper Restriction of XML External Entity Reference

  CVE-2023-27554May 11, 2023IBM

  IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID

• 7.5 High severity

  Java: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2023-30441Apr 29, 2023IBM

  IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.

• 9.8 Critical severity

  WebSphere Application Server: Improper Control of Generation of Code

  CVE-2023-23477Feb 3, 2023IBMEPSS 2.03%

  IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.

• 7.5 High severity

  WebSphere Application Server: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2022-43917Jan 26, 2023IBM

  IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server tradition

• 8.8 High severity

  WebSphere Application Server Liberty: Authentication Bypass by Spoofing

  CVE-2022-22476Jul 8, 2022IBM

  IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.

• 9.8 Critical severity

  IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Exploited

  CVE-2015-7450Jan 2, 2016IBMEPSS 97.8%

  Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer