Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, with the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1,...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, with the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2....

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Discovery Cartridge affected by vulnerability in IBM WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in brace-expansion

Summary IBM Watson Discovery Cartridge affected by vulnerability in brace-expansion Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affect...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, with the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1,...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM WebSphere Hybrid Edition, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM WebSphere Hybrid Edition, are affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31, which is bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM Cloud Pak for Applications, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM Cloud Pak for Applications, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM Enterprise Application Runtimes, is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9, which is bundled with IBM Enterprise Application Runtimes, is affected by multiple vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation (CVE-2026-11545)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Produc...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products an...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Security Bulletin: IBM Terracotta is affected by Logback vulnerabilities that could allow attackers to exploit conditional configuration file processing

Summary IBM Terracotta uses Logback for logging purposes within the product. Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit...

Security Bulletin: Uncontrolled Resource Consumption Security Vulnerability in Jackson-core Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-0003)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint default: 1000 characters defined in...

Security Bulletin: Denial of Service Security Vulnerability in Json-smart Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2024-57699)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2024-57699 DESCRIPTION: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large...

Security Bulletin: IBM DB2 Developer extension is affected via vulnerability in spring-web(CVE-2026-22740)

Summary IBM DB2 Developer extension is affected via vulnerability in spring-webCVE-2026-22740 Vulnerability Details CVEID:CVE-2026-22740 DESCRIPTION: A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (Java CPU August 2026)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: IBM watsonx Code Assistant On Prem product impacted by Vulnerability Found in runtime-7.26.10.tgz

Summary A vulnerability CVE-2025-27789 has been identified in the Babel runtime package @babel/runtime version 7.26.10 and earlier, which impacts the IBM watsonx Code Assistant On Prem Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 11 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.4.0 Patch 6 Vulnerability Details CVEID:CVE-2026-18446 DESCRIPTION: fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 12 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend a...

Security Bulletin: Multiple Security Vulnerabilities in Netty Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-44250 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions...

Security Bulletin: Multiple Security Vulnerabilities in Spring HATEOAS Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilties with an update. Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5,...

Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-10842 DESCRIPTION: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional...

Security Bulletin: Denial of Service Security Vulnerability in Apache HttpComponents Core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-54428)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-54428 DESCRIPTION: Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5.4.2 and earlier,...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by an improper validation vulnerability in Bcpkix CVE-2025-12802, an allocation of resources without limits vulnerability in Bcpkix CVE-2026-13586, an allocation of resources without limits vulnerability in Bcpkix CVE-2026-15055, an improper...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by a broken cryptographic algorithm vulnerability in Bcprov CVE-2025-14813, an LDAP injection vulnerability in Bcprov CVE-2026-0636, a memory allocation with excessive size value vulnerability in Bcprov CVE-2026-12185, an improper validation of...

Security Bulletin: Multiple Security Vulnerabilities in Spring Security affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-40988 DESCRIPTION: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable...

Security Bulletin: Multiple Security Vulnerabilities in Log4j Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer...

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-22745 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an...

Security Bulletin: Multiple Security Vulnerabilities in IBM WebSpheere Application Server affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-3621 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to...

Security Bulletin: IBM Sterling File Gateway is Vulnerable to Authentication Bypass (CVE-2026-75878)

Summary IBM Sterling File Gateway has addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-75878 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an...

Security Bulletin: Insecure Temporary File in Spring Boot affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-40973)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When...

Security Bulletin: The Manager for YARA and SIGMA App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Manager for YARA and SIGMA App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2024-47081 DESCRIPTION:...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-41115 DESCRIPTION: An improper authorization vulnerability has been identified in Apache Kafka. The...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and...