Skip to content
OpenAdvisories
High WID-SEC-2026-2564 16 CVEs

IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen

Published Jul 28, 2026 · Updated Oct 4, 2026 · Revision 13 · de-DE

Vendor: IBM Product: Business Automation Workflow Product: DevOps Code ClearCase Product: i Product: Rational ClearCase Product: Rational ClearQuest Product: SPSS Product: Tivoli Key Lifecycle Manager Product: Tivoli Monitoring Product: Tivoli Network Manager Product: TXSeries Product: WebSphere Application Server Product: WebSphere Application Server - Liberty Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

IBM WebSphere Application Server Liberty ist ein leichter, dynamischer Anwendungsserver zur Entwicklung und Bereitstellung von Java-Anwendungen und Microservices.
IBM WebSphere Application Server ist ein J2EE-Applikationsserver.

Vulnerabilities 16

  • Critical 9.8
    CVE-2026-14446

    IBM WebSphere Application Server is affected by a privilege escalation

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2026-14512

    IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

    IBM WebSphere Application Server
  • Critical 9.4
    CVE-2026-14529

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 8.7
    CVE-2026-15064

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 8.7
    CVE-2026-15325

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 8.3
    CVE-2026-14980

    IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

    IBM WebSphere Application Server - Liberty
  • High 8.1
    CVE-2026-14974

    IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

    IBM WebSphere Application Server
  • High 7.5
    CVE-2026-14981

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 7.5
    CVE-2026-15280

    IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

    IBM WebSphere Application Server - Liberty
  • High 7.4
    CVE-2026-14528

    IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

    IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

    IBM WebSphere Application Server
  • High 7.4
    CVE-2026-15328

    IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 7.1
    CVE-2026-14976

    IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

    IBM WebSphere Application Server - Liberty
  • High 7.1
    CVE-2026-16192

    IBM WebSphere Application Server Liberty is affected by a denial of service

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

    IBM WebSphere Application Server - Liberty
  • High 7.0
    CVE-2026-16184

    IBM WebSphere Application Server is affected by an authentication bypass

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

    IBM WebSphere Application Server
  • Medium 6.1
    CVE-2026-14515

    IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.

    IBM WebSphere Application Server
  • Low 3.1
    CVE-2026-2482

    IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

    IBM WebSphere Application Server - Liberty

Revision history

  1. #13

    Neue Updates von IBM aufgenommen

  2. #12

    Neue Updates von IBM aufgenommen

  3. #11

    Neue Updates von IBM aufgenommen

  4. #10

    Neue Updates von IBM aufgenommen

  5. #9

    Neue Updates von IBM aufgenommen

  6. #8

    Neue Updates von IBM aufgenommen

  7. #7

    Neue Updates von IBM aufgenommen

  8. #6

    Neue Updates von IBM aufgenommen

  9. #5

    Neue Updates von IBM aufgenommen

  10. #4

    Neue Updates von IBM aufgenommen

  11. #3

    Betroffene Versionen überarbeitet

  12. #2

    Referenz(en) aufgenommen: EUVD-2026-50448, EUVD-2026-50447

  13. #1

    Initiale Fassung

References