Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2024-40094)

Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service attack. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENF...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability (CVE-2026-11806)

Summary IBM WebSphere Application Server Liberty is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: IBM Transformation Extender Advanced is affected by IBM WebSphere Application Server Liberty vulnerabilities

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine uses WebSphere Application Server Liberty which is affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update

Summary Identity Insight customers are advised to update IBM WebSphere Liberty Profile WLP to version 26.0.0.8 for security update in WLP. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|-...

CVE-2026-18715 IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-18715

CVE-2026-18715 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The issue arises from improper processing of XML external entities, allowing a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 6.5 (Network, Low attack complexity, Privileg...

CVE-2026-14525

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

CVE-2026-10571

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled...

CVE-2026-16674 IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...

CVE-2026-16674

IBM i 7.3–7.6 are affected by CVE-2026-16674, enabling a remote authenticated attacker to execute arbitrary code due to an untrusted search path. The IBM bulletin lists affected releases and fixes: 7.6 SJ10874/SJ11023, 7.5 SJ10875/SJ11024, 7.4 SJ10876/SJ11025, 7.3 SJ10877/SJ11026. Remediation is ...

CVE-2026-14525

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

CVE-2026-14525

IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8) is affected by an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. The underlying issue is CWE-306: Missing Authentication for Critical Function, with CVSS v3.1 base score 9.4 (Network attack, ...

EUVD-2026-58362

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

CVE-2026-14525 IBM WebSphere Application Server Liberty is affected by an authenication bypass

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

EUVD-2026-58359

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled...

CVE-2026-10571

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled...

CVE-2026-10571 IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled...

CVE-2026-10571

CVE-2026-10571 affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8. The vulnerability is a DoS due to insecure deserialization, exploitable by a low-privileged administrative user when the restConnector-2.0 feature is enabled. CVSS v3.1 base score is 5.7 (I: HIGH, ...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.9 DoS (7283485)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7283485 advisory. - IBM WebSphere Application Server Liberty is affected by a denial of service caused by insecure deserialization. A low-privileged,...