DeutschShown in its original language — a full translation is planned for a future version.
IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen
view advisory published 2026-10-13
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-95696US | high7.5 | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. | ||||
| CVE-2026-95695US | critical9.1OT elevated | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. | ||||
| CVE-2026-93909US | critical9.1 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. | ||||
| CVE-2026-93905US | high8.2 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. | ||||
| CVE-2026-93895US | critical9.1 | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | ||||
| CVE-2026-105443US | high8.2 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | ||||
| CVE-2026-105442US | high7.5 | — | ||
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of s… | ||||
| CVE-2026-101294US | high8.7 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signat… | ||||
| CVE-2026-76646US | — | — | ||
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.
Older unsu… | ||||
| CVE-2026-68536US | — | — | ||
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions 2.3.12, 2… | ||||
| CVE-2026-84375US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-3909 - CSAF Versionself
- WID-SEC-2026-3909 - Portal Versionself
- IBM Security Bulletin 7292219 vom 2026-10-13external
- IBM Security Bulletin 7292221 vom 2026-10-13external
- IBM Security Bulletin 7292226 vom 2026-10-13external
- IBM Security Bulletin 7292227 vom 2026-10-13external
- IBM Security Bulletin 7292228 vom 2026-10-13external
- IBM Security Bulletin 7292232 vom 2026-10-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan