DeutschShown in its original language — a full translation is planned for a future version.
IBM WebSphere Application Server Liberty: Mehrere Schwachstellen
view advisory published 2026-09-08
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und Informationen offenzulegen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-11722US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11549US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. | ||||
| CVE-2026-11548US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-10841US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling. | ||||
| CVE-2026-15634US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper… | ||||
| CVE-2026-15412US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to conduct phishing attacks, u… | ||||
| CVE-2026-15396US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper… | ||||
| CVE-2026-66144US | — | — | ||
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy… | ||||
| CVE-2026-66143US | — | — | ||
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of… | ||||
| CVE-2026-66142US | — | — | ||
Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-3275 - CSAF Versionself
- WID-SEC-2026-3275 - Portal Versionself
- IBM Security Bulletin 7286611 vom 2026-09-08external
- IBM Security Bulletin 7286659 vom 2026-09-08external
- IBM Security Bulletin 7287332 vom 2026-09-15external
- IBM Security Bulletin 7287346 vom 2026-09-15external
- IBM Security Bulletin 7287665 vom 2026-09-15external
- IBM Security Bulletin 7288621 vom 2026-09-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan