DeutschShown in its original language — a full translation is planned for a future version.
IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen
view advisory published 2026-06-23
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-11536US | — | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | ||||
| CVE-2026-11707US | — | — | ||
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login pa… | ||||
| CVE-2026-11383US | — | — | ||
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. | ||||
| CVE-2026-11541US | critical9.8 | — | ||
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 throug… | ||||
| CVE-2026-11594US | medium6.1 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. | ||||
| CVE-2026-11806US | high7.5 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. | ||||
| CVE-2026-42404US | high7.2 | — | ||
Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API… | ||||
| CVE-2026-42403US | — | — | ||
Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B… | ||||
| CVE-2026-42402US | — | — | ||
Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential C… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-2050 - CSAF Versionself
- WID-SEC-2026-2050 - Portal Versionself
- IBM Security Bulletin 7277531 vom 2026-06-23external
- IBM Security Bulletin 7277536 vom 2026-06-23external
- IBM Security Bulletin 7277544 vom 2026-06-23external
- IBM Security Bulletin 7277546 vom 2026-06-23external
- IBM Security Bulletin 7277550 vom 2026-06-23external
- IBM Security Bulletin 7278103 vom 2026-06-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan