Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for September 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF003, 25.0.0-IF007 and 24.0.0-IF009. These vulnerabilities have been also addressed in 24.0.1-IF009 Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7 is vulnerable to...

WebSphere-WSIF-gadget

WSIF Gadget para WebSphere CVE-2020-4464 / CVE-2020-4450 Esto se basa en las excelentes entradas de blog de ZDI informe original de @tint0: https://www.thezdi.com/blog/2020/7/20/abusing-java-remote-protocols-in-ibm-websphere...

CVE-2016-5983

CVE-2016-5983 IBM WebSphere 不可信数据反序列化 - IBM WebSphere 7,8,8.5,9 原始文章来源链接：https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ 标题：IBM WebSphere 不可信数据反序列化 应用程序：IBM WebSphere 7,8,8.5,9 描述：当存在 WASPostParam cookie 时，应用服务器会对不可信数据进行反序列化。...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-15396, CVE-2026-15412, CVE-2026-15634 Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM Verify Identity Governance Container affected by multiple vulnerabilities

Summary Multiple security vulnerabilities affecting dependent components used by IBM Verify Identity Governance Container have been addressed in the latest product update. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily...

Security Bulletin: WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by a privilege escalation (CVE-2026-11545)

Summary WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to t...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms. IBM WebSphere Liberty has been updated within TXSeries for Multiplatforms to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM...

CVE-2026-11711

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component...

CVE-2026-11710

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-11539

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector...

CVE-2026-11545

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks...

CVE-2026-11538

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

EUVD-2026-83290

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722 Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722

CVE-2026-11722 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The vulnerability requires no authentication and has high attack complexity, with lo...