Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities due to RESTEasy and Apache CXF

Summary There are mulitple vulnerabilities in the RESTEasy and Apache CXF library that affect IBM WebSphere Application Server Liberty with the restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0 or xmlWS-4.0 enabled. Vulnerability Details CVEID:CVE-2026-108039...

IBM WebSphere Application Server 8.5.x < 8.5.5.32 / 9.x < 9.0.5.30 (7295372)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7295372 advisory. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an...

IBM WebSphere Application Server 9.x < 9.0.5.30 (7292227)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7292227 advisory. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.j...

Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: IBM i is Affected by Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-14532, CVE-2026-79715, CVE-2026-93879, CVE-2026-91865, CVE-2026-91863, CVE-2026-91864, CVE-2026-89058, CVE-2026-89059, CVE-2026-108039, CVE-2026-107937, CVE-2026-10844, CVE-2026-11547, CVE-2026-78636, CVE-2026-103320, CVE-2026-10828...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-93895 DESCRIPTION: IBM WebSphere Application Server - Liberty 20.0.0.12...

CVE-2026-78636

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser...

CVE-2026-78636 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser...

CVE-2026-78636

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by an information disclosure vulnerability (CVE-2026-78636 ). The root cause is unsafe class reflection within the JMX REST connector body parser (CWE-470). This flaw could allow an attacker to disclose info...

EUVD-2026-119725

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser...

CVE-2026-11547

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

CVE-2026-108284

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information...

CVE-2026-10844

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks...

CVE-2026-11547 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

CVE-2026-11547

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by a server-side request forgery (SSRF) vulnerability in the Admin Center deploy validation endpoint. This vulnerability, tracked as CVE-2026-11547 , allows an attacker to potentially conduct requests from t...

EUVD-2026-119687

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint...

EUVD-2026-119692

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks...

CVE-2026-10844

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by CVE-2026-10844 , a vulnerability involving CWE-601: URL Redirection to Untrusted Site (Open Redirect). This flaw could allow a remote attacker to conduct phishing attacks . To remediate this issue, IBM re...

CVE-2026-10844 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks...

CVE-2026-108284

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by a vulnerability that could allow an authenticated user with the Reader role to obtain sensitive information . This issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized ...