CVE-2026-15412: URL Redirection to Untrusted Site

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

CVE-2026-15396: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

PT-2026-91449

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

CVE-2026-16185: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2026-9176

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

CVE-2026-9667

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9327

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-9667 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

EUVD-2026-75747

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9667 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9667

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) (CWE-918), allowing a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. The impact is limited to low confidentiality per the CVSS 3.1 score of 5.3...

CVE-2026-9176 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

CVE-2026-9176 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

CVE-2026-9176

IBM WebSphere Application Server versions 9.0 and 8.5 are vulnerable to a security bypass caused by improper authentication controls, allowing a local attacker to escalate privileges and gain unauthorized access to protected resources. Affected versions are prior to 9.0.5.29 and 8.5.5.31 . The vu...

CVE-2026-9327 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

EUVD-2026-75733

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-9327 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-9327

IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are vulnerable to improper privilege management (CWE-269). An authenticated user with a low-privilege administrative role can modify security configuration, potentially leading to information disclosure or denial of service ...

CVE-2026-9336

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space...