Security Bulletin: IBM WebSphere Automation is affected by CVE-2026-41115 in the kafka-clients package

Summary IBM WebSphere Automation is affected by CVE-2026-41115 in the kafka-clients package Vulnerability Details CVEID:CVE-2026-41115 DESCRIPTION: An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by cross-site scripting and deserialization vulnerabilities

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

IBM WebSphere Application Server input validation error vulnerability

IBM WebSphere Application Server is an application server product from IBM. Versions 8.5 and 9.0 of IBM WebSphere Application Server have security vulnerabilities. These vulnerabilities stem from input validation flaws in the HTTP request parsing component, leading to inconsistent interpretation ...

CVE-2026-11536

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-11536 IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-11536

CVE-2026-11536 affects IBM WebSphere Application Server versions including 8.5 and 9.0 (SOAP/JMX connector). Connected documents confirm an RCE vulnerability via the SOAP/JMX/HTTP interface with CWE-502 (Deserialization of Untrusted Data) and IBM CVSS data (up to 8.8 base score in some bulletins;...

CVE-2026-9322

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...

CVE-2026-14980

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...

CVE-2026-11897

IBM WebSphere Application Server Liberty (17.0.0.3–26.0.0.7) is affected by CVE-2026-11897, a denial-of-service vulnerability triggered by specially crafted HTTP/2 requests. The issue impacts Liberty with servlet-3.1/4.0/5.0/6.x features enabled, allowing a remote attacker to exhaust memory resou...

CVE-2026-11383 Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...

CVE-2026-14980 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...

CVE-2026-14980 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...

CVE-2026-14976

creationtimestamp| type| source ---|---|--- 2026-07-30 05:15:12+00:00| seen| https://www.hkcert.org/security-bulletin/ibm-websphere-products-multiple-vulnerabilities20260730...

CVE-2026-15328

creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:57+00:00| seen| https://www.hkcert.org/security-bulletin/ibm-websphere-products-multiple-vulnerabilities20260730...

PT-2026-66508

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 8.5 IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 Description Remote attackers could bypass security constraints in both...

CVE-2026-11536: Deserialization of Untrusted Data

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-10842: Authentication Bypass by Alternate Name

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints...

CVE-2026-11707: Improper Neutralization of Input During Web Page Generation

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page...

CVE-2026-14980: Improper Privilege Management

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...

CVE-2026-11897: Allocation of Resources Without Limits or Throttling

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...