Skip to content
OpenAdvisories
High WID-SEC-2026-3909 11 CVEs

IBM WebSphere Application Server und Application Server Liberty: Mehrere Schwachstellen

Published Oct 13, 2026 · Updated Nov 9, 2026 · Revision 6 · de

Vendor: IBM Product: Business Automation Workflow Product: i Product: License Metric Tool Product: Rational ClearQuest Product: TXSeries Product: WebSphere Application Server Product: WebSphere Application Server - Liberty Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty und IBM WebSphere Application Server ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

IBM WebSphere Application Server Liberty ist ein leichter, dynamischer Anwendungsserver zur Entwicklung und Bereitstellung von Java-Anwendungen und Microservices.
IBM WebSphere Application Server ist ein J2EE-Applikationsserver.

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-68536

    Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

    Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.  Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

    Apache Software Foundation Apache MyFaces
  • Critical 9.1
    CVE-2026-93895

    IBM WebSphere Application Server Liberty Improper Access Control

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

    IBM WebSphere Application Server - Liberty
  • Critical 9.1
    CVE-2026-93909

    IBM WebSphere Application Server Liberty is affected by an authentication bypass

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

    IBM WebSphere Application Server - Liberty
  • High 8.7
    CVE-2026-101294

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 8.2
    CVE-2026-105443

    IBM WebSphere Application Server Liberty is affected by an improper access control

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.

    IBM WebSphere Application Server - Liberty
  • High 8.2
    CVE-2026-93905

    IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

    IBM WebSphere Application Server - Liberty
  • High 7.5
    CVE-2026-105442

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • High 7.5
    CVE-2026-76646

    Apache MyFaces: Denial of Service via Unbounded Request Parsing

    A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versio…

    Apache Software Foundation Apache MyFaces
  • High 7.5
    CVE-2026-84375

    js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large seque…

    nodeca js-yaml katib-suggestion-hyperopt renovate Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-95695

    IBM WebSphere Application Server Liberty Incorrect Authorization

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

    IBM WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-95696

    IBM WebSphere Application Server Liberty Denial of Service

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.

    IBM WebSphere Application Server - Liberty

Revision history

  1. #6

    Neue Updates von IBM aufgenommen

  2. #5

    Neue Updates von IBM aufgenommen

  3. #4

    Neue Updates von IBM aufgenommen

  4. #3

    Neue Updates von IBM aufgenommen

  5. #2

    Neue Updates von IBM aufgenommen

  6. #1

    Initiale Fassung

References