DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-13
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-95696US | high7.5 | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. | ||||
| CVE-2026-95695US | critical9.1OT erhöht | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. | ||||
| CVE-2026-93909US | critical9.1 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. | ||||
| CVE-2026-93905US | high8.2 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. | ||||
| CVE-2026-93895US | critical9.1 | — | ||
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | ||||
| CVE-2026-105443US | high8.2 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | ||||
| CVE-2026-105442US | high7.5 | — | ||
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of s… | ||||
| CVE-2026-101294US | high8.7 | — | ||
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signat… | ||||
| CVE-2026-76646US | — | — | ||
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition.
Older unsu… | ||||
| CVE-2026-68536US | — | — | ||
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions 2.3.12, 2… | ||||
| CVE-2026-84375US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2026-3909 - CSAF Versionself
- WID-SEC-2026-3909 - Portal Versionself
- IBM Security Bulletin 7292219 vom 2026-10-13external
- IBM Security Bulletin 7292221 vom 2026-10-13external
- IBM Security Bulletin 7292226 vom 2026-10-13external
- IBM Security Bulletin 7292227 vom 2026-10-13external
- IBM Security Bulletin 7292228 vom 2026-10-13external
- IBM Security Bulletin 7292232 vom 2026-10-13external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan