Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Automation Workflow

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-95695

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-95696

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception...

CVE-2026-93895

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods...

CVE-2026-93909

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled...

CVE-2026-93905

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances...

CVE-2026-77816

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2026-79715

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

CVE-2026-14909

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled...

CVE-2026-14532

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception...

CVE-2026-11713

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled...

CVE-2026-105443

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...

CVE-2026-105442

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service...

CVE-2026-101294

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature...

CVE-2026-93905 IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances...

CVE-2026-93905

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to a deserialization of untrusted data (CWE-502) when the batchManagement-1.0 feature is enabled. This vulnerability could allow an unauthenticated remote attacker to corrupt the persisted status of batch ...

CVE-2026-93909 IBM WebSphere Application Server Liberty is affected by an authentication bypass

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled...

CVE-2026-93909

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are vulnerable to an authentication bypass vulnerability when the samlWeb-2.0 feature is enabled. This issue is associated with CWE-384 (Session Fixation) and carries a CVSS 3.1 base score of 9.1 (CRITICAL) . The vulnera...

CVE-2026-93895

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to an Improper Access Control flaw (CWE-284 ). When the grpc-1.0 feature is enabled, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods . This vulnerability...

CVE-2026-95695 IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization...