CVE-2026-10842

🗓️ 30 Jul 2026 15:57:16Reported by ibmType

Remote attacker could bypass security constraints in WebSphere Application Server versions eight five and nine zero, and Liberty versions seventeen point zero point zero three to twenty six point zero point zero seven.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a security bypass vulnerability (CVE-2026-10842)	4 Aug 202616:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVE-2026-10842)	16 Jul 202621:00	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-10842)	29 Jul 202620:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVE-2026-10842)	5 Aug 202606:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by a security bypass vulnerability (CVE-2026-10842)	4 Aug 202616:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability	5 Aug 202619:30	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been identified in WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager (GKLM) (CVE-2026-10842)	6 Aug 202609:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a security bypass vulnerability	28 Jul 202607:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a security bypass vulnerability (CVE-2026-10842)	4 Aug 202616:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow	5 Aug 202608:30	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5.0.0–8.5.5.31

ibm websphere_application_serverRange9.0.0.0–9.0.5.29

ibm websphere_application_serverRange17.0.0.3–26.0.0.8liberty

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "9.0"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*"
    ]
  },
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.7",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.7:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7280131

05 Aug 2026 14:15Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.0031

SSVC

CWE-289