PT-2026-91420

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

PT-2026-91453

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

PT-2026-91419

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...

PT-2026-91421

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-15634: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

CVE-2026-15396: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

PT-2026-91448

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

CVE-2026-16185: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...

CVE-2026-16435: Trusting HTTP Permission Methods on the Server Side

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

CVE-2026-15887: Server-Side Request Forgery (SSRF)

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15412: URL Redirection to Untrusted Site

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could...

CVE-2026-16186: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2026-9176

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

CVE-2026-9667

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9327

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

CVE-2026-9667 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9667 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

EUVD-2026-75747

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery SSRF that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints...

CVE-2026-9667

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) (CWE-918), allowing a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. The impact is limited to low confidentiality per the CVSS 3.1 score of 5.3...