Advisories · Technology

IBM WebSphere Application Server.

Every CVE that names IBM WebSphere Application Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-101294 CVE record

CVSS 8.7 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
- IBM WebSphere Application Server - Liberty
- IBM WebSphere Application Server
- CWE-325
Not analysed yet 13 Oct 2026
CVE-2026-105442 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-93907 CVE record

CVSS 8.1 High

IBM WebSphere Application Server is affected by a bypass authentication vulnerability
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 13 Oct 2026
CVE-2026-95680 CVE record

CVSS 8.0 High

IBM WebSphere Application Server is affected by an authorization bypass
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 13 Oct 2026
CVE-2026-103499 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
- IBM WebSphere Application Server - Liberty
- IBM WebSphere Application Server
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-11722 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 18 Sept 2026
CVE-2026-11711 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 18 Sept 2026
CVE-2026-11710 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability
- IBM WebSphere Application Server
- HTTP request smuggling
Not analysed yet 18 Sept 2026
CVE-2026-11549 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-11548 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 18 Sept 2026
CVE-2026-11545 CVE record

CVSS 3.7 Low

IBM WebSphere Application Server is affected by a privilege escalation
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-11540 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-11539 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 18 Sept 2026
CVE-2026-11538 CVE record

CVSS 3.7 Low

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Other injection
Not analysed yet 18 Sept 2026
CVE-2026-11537 CVE record

CVSS 4.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- CWE-650
Not analysed yet 18 Sept 2026
CVE-2026-10841 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 18 Sept 2026
CVE-2026-15396 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 14 Sept 2026
CVE-2026-15412 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Open redirect
Not analysed yet 14 Sept 2026
CVE-2026-15634 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 14 Sept 2026
CVE-2026-15887 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 14 Sept 2026
CVE-2026-16186 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 14 Sept 2026
CVE-2026-16185 CVE record

CVSS 6.4 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-16187 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-16188 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Other injection
Not analysed yet 14 Sept 2026
CVE-2026-16190 CVE record

CVSS 3.1 Low

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-16189 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Other injection
Not analysed yet 14 Sept 2026
CVE-2026-16435 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- CWE-650
Not analysed yet 14 Sept 2026
CVE-2026-9667 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Sept 2026
CVE-2026-9176 CVE record

CVSS 6.7 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Code injection
Not analysed yet 10 Sept 2026
CVE-2026-9327 CVE record

CVSS 6.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Privilege escalation
Not analysed yet 10 Sept 2026
CVE-2026-9336 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 10 Sept 2026
CVE-2026-9338 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Denial of service
Not analysed yet 10 Sept 2026
CVE-2026-8400 CVE record

CVSS 8.1 High

Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Code injection
Not analysed yet 5 Aug 2026
CVE-2026-11536 CVE record

CVSS 8.5 High

IBM WebSphere Application Server is affected by a remote code execution vulnerability
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 30 Jul 2026
CVE-2026-9322 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Denial of service
Not analysed yet 30 Jul 2026
CVE-2026-10842 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- CWE-289
Not analysed yet 30 Jul 2026
CVE-2026-14529 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Authentication bypass
Not analysed yet 29 Jul 2026
CVE-2026-14446 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by a privilege escalation
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 28 Jul 2026
CVE-2026-14515 CVE record

CVSS 6.1 Medium

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 28 Jul 2026
CVE-2026-14512 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 28 Jul 2026
CVE-2026-14528 CVE record

CVSS 7.4 High

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
- IBM WebSphere Application Server
- Information disclosure
Not analysed yet 28 Jul 2026
CVE-2026-14974 CVE record

CVSS 8.1 High

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 28 Jul 2026
CVE-2026-14981 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Denial of service
Not analysed yet 28 Jul 2026
CVE-2026-15064 CVE record

CVSS 8.7 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 28 Jul 2026
CVE-2026-15325 CVE record

CVSS 8.7 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 28 Jul 2026
CVE-2026-15328 CVE record

CVSS 7.4 High

IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 28 Jul 2026
CVE-2026-16184 CVE record

CVSS 7.0 High

IBM WebSphere Application Server is affected by an authentication bypass
- IBM WebSphere Application Server
- Broken access control
Not analysed yet 28 Jul 2026
CVE-2026-11594 CVE record

CVSS 8.5 High

IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 30 Jun 2026
CVE-2026-11595 CVE record

CVSS 4.3 Medium

IBM WebSphere Application Server is affected by a Path Traversal vulnerability
- IBM WebSphere Application Server
- Path traversal
Not analysed yet 30 Jun 2026
CVE-2026-11708 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 30 Jun 2026
CVE-2026-11712 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 30 Jun 2026
CVE-2026-10852 CVE record

CVSS 5.9 Medium

Websphere Application Server is Affected By a Denial of Service
- IBM WebSphere Application Server
- Memory corruption
Not analysed yet 22 Jun 2026
CVE-2026-9320 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Denial of service
Not analysed yet 22 Jun 2026
CVE-2026-9071 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Denial of service
Not analysed yet 22 Jun 2026
CVE-2026-9006 CVE record

CVSS 7.4 High

IBM WebSphere Application Server is affected by server-side request forgery
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 22 Jun 2026
CVE-2026-8646 CVE record

CVSS 7.4 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
Not analysed yet 22 Jun 2026
CVE-2026-10845 CVE record

CVSS 7.3 High

IBM WebSphere Application Server is affected by an authentication bypass vulnerability
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 22 Jun 2026
CVE-2026-9072 CVE record

CVSS 8.1 High

WebSphere Application Server Remote Code Execution
- IBM WebSphere Application Server
- Code injection
Not analysed yet 22 Jun 2026
CVE-2026-8858 CVE record

CVSS 7.5 High

WebSphere Application Server Remote Code Execution
- IBM WebSphere Application Server
- Code injection
Not analysed yet 22 Jun 2026
CVE-2026-9330 CVE record

CVSS 8.5 High

IBM WebSphere Application Server is affected by remote code execution
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 1 Jun 2026