DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-28
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-14980US | high8.8 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated… | ||||
| CVE-2026-2482US | high8.8 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… | ||||
| CVE-2026-14529US | critical9.8OT erhöht | — | ||
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSR… | ||||
| CVE-2026-15328US | high8.1 | — | ||
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling. | ||||
| CVE-2026-15325US | — | — | ||
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests. | ||||
| CVE-2026-15280US | — | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechan… | ||||
| CVE-2026-15064US | — | — | ||
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper hand… | ||||
| CVE-2026-14981US | — | — | ||
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP… | ||||
| CVE-2026-14976US | critical9.8OT erhöht | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled. | ||||
| CVE-2026-14974US | critical9.8 | — | ||
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data. | ||||
| CVE-2026-14528US | high7.5 | — | ||
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. | ||||
| CVE-2026-14515US | — | — | ||
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. | ||||
| CVE-2026-14512US | — | — | ||
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or… | ||||
| CVE-2026-14446US | —OT erhöht | — | ||
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. | ||||
| CVE-2026-16192US | medium6.5 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled. | ||||
| CVE-2026-16184US | critical9.8OT erhöht | — | ||
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2026-2564 - CSAF Versionself
- WID-SEC-2026-2564 - Portal Versionself
- IBM Security Bulletin 7281625 vom 2026-07-28external
- IBM Security Bulletin 7281628 vom 2026-07-28external
- IBM Security Bulletin 7281631 vom 2026-07-28external
- IBM Security Bulletin 7281633 vom 2026-07-28external
- IBM Security Bulletin 7281641 vom 2026-07-28external
- IBM Security Bulletin 7281648 vom 2026-07-28external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan