IBM Websphere Application Server Liberty vulnerabilities
44 vulnerabilities
Known vulnerabilities in IBM Websphere Application Server Liberty, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-103499ibmwebsphere_application_server+1
EPSS score0.40%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.CVE-2026-95696ibmwebsphere application server - libertyEPSS score0.32%
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.CVE-2026-95695ibmwebsphere application server - libertyEPSS score0.33%
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.CVE-2026-93909ibmwebsphere application server - libertyEPSS score0.35%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.CVE-2026-93905ibmwebsphere application server - libertyEPSS score0.33%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.CVE-2026-93895ibmwebsphere application server - libertyEPSS score0.45%
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.CVE-2026-79715ibmwebsphere application server - libertyEPSS score0.14%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.CVE-2026-77816ibmwebsphere application server - libertyEPSS score0.23%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.CVE-2026-14909ibmwebsphere application server - libertyEPSS score0.29%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.CVE-2026-14532ibmwebsphere application server - libertyEPSS score0.21%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.CVE-2026-11713ibmwebsphere application server - libertyEPSS score0.18%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.CVE-2026-105443ibmwebsphere application server - libertyEPSS score0.23%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.CVE-2026-105442ibmwebsphere_application_server+1EPSS score0.40%
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.CVE-2026-101294ibmwebsphere_application_server+1EPSS score0.21%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.CVE-2025-14917ibmwebsphere_application_server+1EPSS score0.40%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.CVE-2025-14915ibmwebsphere_application_server+1EPSS score0.56%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.CVE-2025-14923ibmwebsphere_application_server+1EPSS score0.18%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.CVE-2026-16192ibmwebsphere_application_server+1EPSS score0.37%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.CVE-2026-2482ibmwebsphere_application_server+1EPSS score0.15%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.CVE-2026-11806ibmwebsphere_application_server+1EPSS score0.47%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.