Skip to content
OpenAdvisories
High WID-SEC-2026-2050 9 CVEs

IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen

Published Jun 23, 2026 · Updated Sep 14, 2026 · Revision 14 · de-DE

Vendor: IBM Product: App Connect Enterprise Product: Business Automation Workflow Product: DevOps Code ClearCase Product: i Product: License Metric Tool Product: MQ Product: Rational ClearCase Product: Rational ClearQuest Product: SPSS Product: Tivoli Monitoring Product: Tivoli Network Manager Product: TXSeries Product: WebSphere Application Server Product: WebSphere Application Server - Liberty Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

IBM WebSphere Application Server Liberty ist ein leichter, dynamischer Anwendungsserver zur Entwicklung und Bereitstellung von Java-Anwendungen und Microservices.
IBM WebSphere Application Server ist ein J2EE-Applikationsserver.

Vulnerabilities 9

  • Critical 9.3
    CVE-2026-11707

    Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

    IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

    IBM Tivoli System Automation Application Manager
  • High 8.5
    CVE-2026-11536

    IBM WebSphere Application Server is affected by a remote code execution vulnerability

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

    IBM WebSphere Application Server
  • High 8.5
    CVE-2026-11594

    IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

    IBM WebSphere Application Server
  • High 7.5
    CVE-2026-42402

    Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS

    Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbo…

    Apache Software Foundation Apache Neethi wildfly-openjdk-17 wildfly-openjdk-21 Wolfi Maven
  • High 7.5
    CVE-2026-42403

    Apache Neethi: Circular Policy Reference Infinite Loop

    Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infin…

    Apache Software Foundation Apache Neethi wildfly-openjdk-17 wildfly-openjdk-21 Wolfi Maven
  • High 7.4
    CVE-2026-11541

    Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.

    IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

    IBM CICS Transaction Gateway for Multiplatforms
  • High 7.2
    CVE-2026-11806

    IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

    IBM WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-42404

    Apache Neethi: Unrestricted HTTP Redirect Following in Policy References

    Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitr…

    Apache Software Foundation Apache Neethi wildfly-openjdk-17 wildfly-openjdk-21 Wolfi Maven
  • Medium 5.4
    CVE-2026-11383

    Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

    IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.

    IBM Tivoli System Automation Application Manager

Revision history

  1. #14

    Neue Updates von IBM aufgenommen

  2. #13

    Neue Updates von IBM aufgenommen

  3. #12

    Neue Updates von IBM aufgenommen

  4. #11

    Referenz(en) aufgenommen: EUVD-2026-51141, EUVD-2026-51140, EUVD-2026-51274

  5. #10

    Neue Updates von IBM aufgenommen

  6. #9

    Neue Updates von IBM aufgenommen

  7. #8

    Neue Updates von IBM aufgenommen

  8. #7

    Neue Updates von IBM aufgenommen

  9. #6

    Neue Updates von IBM aufgenommen

  10. #5

    Referenz(en) aufgenommen: EUVD-2026-40394, EUVD-2026-40413, EUVD-2026-40411

  11. #4

    Neue Updates von IBM aufgenommen

  12. #3

    Neue Updates von IBM aufgenommen

  13. #2

    Neue Updates von IBM aufgenommen

  14. #1

    Initiale Fassung

References