IBM WebSphere Application Server - Liberty vulnerabilities

14 CVEs affecting IBM WebSphere Application Server - Liberty, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-95696, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-93895, published 2026-10-13. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-103499, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of…
CVE-2026-105442, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an…
CVE-2026-93909, published 2026-10-13. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905, published 2026-10-13. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-95695, published 2026-10-13. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-95696, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-14909, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when…
CVE-2026-105443, published 2026-10-13. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-77816, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive…

Latest

CVE-2026-79715, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive…
CVE-2026-14532, published 2026-10-13. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
CVE-2026-11713, published 2026-10-13. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.