CVE-2026-3621 IBM WebSphere Application Server Liberty is affected by identity spoofing

🗓️ 22 Apr 2026 23:07:31Reported by ibmType

IBM WebSphere Liberty 17.0.0.3–26.0.0.4 is vulnerable to identity spoofing when deployed without authentication.

Reporter	Title	Published	Views	Family All 29
ibm	Security Bulletin: An Improper Privilege Management vulnerability may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced (CVE-2026-3621).	11 Jun 202621:25	–	ibm
ibm	Security Bulletin: IBM WebSphere Application Server Liberty is affected by identity spoofing (CVE-2026-3621)	22 Apr 202619:15	–	ibm
ibm	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	26 Jun 202620:38	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses WebSphere Application Server Liberty which is vulnerable to CVE-2026-3621.	3 Jun 202614:54	–	ibm
ibm	Security Bulletin: An Improper Privilege Management vulnerability may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms (CVE-2026-3621).	11 Jun 202621:27	–	ibm
ibm	Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty may be affected by identity spoofing (CVE-2026-3621)	2 Jul 202607:14	–	ibm
ibm	Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities	25 Jun 202610:03	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.	30 Jun 202617:46	–	ibm
ibm	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an identity spoofing vulnerability (CVE-2026-3621)	27 Apr 202615:12	–	ibm
ibm	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	26 Jun 202604:48	–	ibm

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.4",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.4:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7270437

22 Apr 2026 23:07Current

CVSS 3.17.5

EPSS0.00276

CWE-269