Skip to content
OpenAdvisories
Medium WID-SEC-2026-3255 27 CVEs

IBM WebSphere Application Server: Mehrere Schwachstellen

Published Sep 8, 2026 · Updated Oct 12, 2026 · Revision 7 · de-DE

Vendor: IBM Product: Business Automation Workflow Product: Rational ClearQuest Product: Tivoli Monitoring Product: Tivoli Network Manager Product: WebSphere Application Server Product: WebSphere Service Registry and Repository Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder Denial-of-Service-Zustände herbeizuführen.

Product

IBM WebSphere Application Server ist ein J2EE-Applikationsserver.

Vulnerabilities 27

  • Medium 6.7
    CVE-2026-9176

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.

    IBM WebSphere Application Server
  • Medium 6.5
    CVE-2026-11549

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-11710

    IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

    IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

    IBM WebSphere Application Server
  • Medium 6.5
    CVE-2026-11711

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

    IBM WebSphere Application Server
  • Medium 6.5
    CVE-2026-15396

    IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially cr…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-15412

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8  could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially craft…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-15634

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially cr…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-16187

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.

    IBM WebSphere Application Server
  • Medium 6.5
    CVE-2026-9336

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem …

    IBM WebSphere Application Server
  • Medium 6.4
    CVE-2026-16185

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.

    IBM WebSphere Application Server
  • Medium 6.3
    CVE-2026-9327

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.

    IBM WebSphere Application Server
  • Medium 5.9
    CVE-2026-16435

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

    IBM WebSphere Application Server
  • Medium 5.4
    CVE-2026-15887

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

    IBM WebSphere Application Server
  • Medium 5.4
    CVE-2026-16186

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

    IBM WebSphere Application Server
  • Medium 5.3
    CVE-2026-11539

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

    IBM WebSphere Application Server
  • Medium 5.3
    CVE-2026-11540

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

    IBM WebSphere Application Server
  • Medium 5.3
    CVE-2026-16188

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

    IBM WebSphere Application Server
  • Medium 5.3
    CVE-2026-9338

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced ava…

    IBM WebSphere Application Server
  • Medium 5.3
    CVE-2026-9667

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

    IBM WebSphere Application Server
  • Medium 4.8
    CVE-2026-10841

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-11548

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-11722

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-16189

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

    IBM WebSphere Application Server
  • Medium 4.3
    CVE-2026-11537

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

    IBM WebSphere Application Server
  • Low 3.7
    CVE-2026-11538

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

    IBM WebSphere Application Server
  • Low 3.7
    CVE-2026-11545

    IBM WebSphere Application Server is affected by a privilege escalation

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

    IBM WebSphere Application Server
  • Low 3.1
    CVE-2026-16190

    IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

    IBM WebSphere Application Server

Revision history

  1. #7

    Neue Updates von IBM aufgenommen

  2. #6

    Neue Updates von IBM aufgenommen

  3. #5

    Referenz(en) aufgenommen: EUVD-2026-83041, EUVD-2026-83030, EUVD-2026-83290, EUVD-2026-83288, EUVD-2026-83287, EUVD-2026-83286, EUVD-2026-83281, EUVD-2026-83280, EUVD-2026-83279, EUVD-2026-83276, EUVD-2026-83278

  4. #4

    Neue Updates von IBM aufgenommen

  5. #3

    Referenz(en) aufgenommen: EUVD-2026-77801, EUVD-2026-77800, EUVD-2026-77796, EUVD-2026-77803, EUVD-2026-77811, EUVD-2026-77806, EUVD-2026-78068, EUVD-2026-78067, EUVD-2026-78060, EUVD-2026-78056, EUVD-2026-78053

  6. #2

    Referenz(en) aufgenommen: EUVD-2026-75677, EUVD-2026-75676, EUVD-2026-75724, EUVD-2026-75733, EUVD-2026-75747

  7. #1

    Initiale Fassung

References