CVE-2026-77816

IBM WebSphere Application Server Liberty Improper Certificate Validation

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Liberty Websphere Application Server Liberty

CVE-2026-11713

IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Liberty Websphere Application Server Liberty

CVE-2026-14532

IBM WebSphere Application Server Liberty Integer Overflow

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Liberty Websphere Application Server Liberty

CVE-2026-15064

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-14981

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-15328

IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-10571

IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Linux and 1 more

Products

Macos Aix I and 6 more

CVE-2026-9322

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-15325

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-11714

IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability

IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-10842

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty Websphere Application Server Liberty

CVE-2026-2482

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-14976

IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty Websphere Application Server Liberty

CVE-2026-14529

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-11541

Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-15057

IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-16192

IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-15280

IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-11546

IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty

CVE-2026-11806

IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Websphere Application Server Liberty