CVE-2026-9176: Improper Control of Generation of Code

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...

Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server Liberty affect IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is exposed to multiple security vulnerabilities, including Tampering / Information Disclosure CVE-2025-12635, Information Disclosure CVE-2025-14923, two Denial of Service CVE-2026-11897 and CVE-2026-15057, and two Elevation of Privilege vulnerabilities...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback, Log4j, Jackson Databind, and various operating system...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to ...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IB...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-16190 DESCRIPTION: IBM WebSphere Application Server is affected by an authorization bypass vulnerability. CWE:CWE-862: Missing Authorization CVSS...

Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-11545 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information from the administrative console due to missing...

Security Bulletin: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability. Vulnerability Details CVEID:CVE-2026-11710 DESCRIPTION: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details CVEID:CVE-2026-49875 DESCRIPTION: Apache CXF's...

Security Bulletin: Due to use of IBM WebSphere Application Server and IBM WebSphere Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Multiple vulnerabilities have been identified in IBM WebSphere Application Server and IBM WebSphere Liberty, supporting product which is shipped as pattern type with IBM Cloud Pak System. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Security Bulletin: A Vulnerability in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU plus deferred CVE-2026-16440

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Security Bulletin: IBM WebSphere Application Server is affected by multiple vulnerabilities (CVE-2026-11712, CVE-2026-11595, CVE-2026-11708)

Summary IBM WebSphere Application Server is affected by cross-sight scripting and path traversal vulnerabilities. Vulnerability Details CVEID:CVE-2026-11595 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service which are vulnerable to CVE-2026-4410, CVE-2026-5516 This bulletin contains information addressing the vulnerability. Vulnerabili...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in IBM WebSphere Liberty impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contai...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

Security Bulletin: Multiple vulnerabilities have been identified in IBM SDK, Java Technology Edition, an IBM Websphere (WAS) prerequisite. WAS is used by IBM Rational ClearQuest

Summary IBM® SDK, Java™ Technology Edition is a prerequisite in order to use IBM WebSphere Application ServerWAS. WAS is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM SDK, Java Technology Edition CSPU have been published in a security bulleti...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for August 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF002 and 24.0.1-IF009. These vulnerabilities have been also addressed in 24.0.0-IF008 and 25.0.0-IF006 Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty...

Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-5516 DESCRIPTION: IBM WebSphere Application Serv...