DeutschShown in its original language — a full translation is planned for a future version.
IBM WebSphere Application Server: Mehrere Schwachstellen
view advisory published 2026-09-08
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder Denial-of-Service-Zustände herbeizuführen.
01
describes (27)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-11722US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11711US | medium6.5 | — | ||
IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component. | ||||
| CVE-2026-11710US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers. | ||||
| CVE-2026-11549US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. | ||||
| CVE-2026-11548US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11545US | low3.7OT elevated | — | ||
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks. | ||||
| CVE-2026-11540US | medium5.3OT elevated | — | ||
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet. | ||||
| CVE-2026-11539US | medium5.3OT elevated | — | ||
IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector. | ||||
| CVE-2026-11538US | medium5.3 | — | ||
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. | ||||
| CVE-2026-11537US | medium4.3 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet. | ||||
| CVE-2026-10841US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling. | ||||
| CVE-2026-16435US | medium5.9 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features. | ||||
| CVE-2026-16190US | low3.1OT elevated | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability. | ||||
| CVE-2026-16189US | medium4.8 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. | ||||
| CVE-2026-16188US | — | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. | ||||
| CVE-2026-16187US | —OT elevated | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request. | ||||
| CVE-2026-16186US | medium5.4 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability. | ||||
| CVE-2026-16185US | —OT elevated | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet. | ||||
| CVE-2026-15887US | medium5.4 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests. | ||||
| CVE-2026-15634US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper… | ||||
showing 20 of 27
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-3255 - CSAF Versionself
- WID-SEC-2026-3255 - Portal Versionself
- IBM Security Bulletin 7286610 vom 2026-09-08external
- IBM Security Bulletin 7286730 vom 2026-09-08external
- IBM Security Bulletin 7286731 vom 2026-09-08external
- IBM Security Bulletin 7287332 vom 2026-09-15external
- IBM Security Bulletin 7287346 vom 2026-09-15external
- IBM Security Bulletin 7287665 vom 2026-09-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan