Skip to content
OpenAdvisories

Product · IBM

WebSphere Application Server

188 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-14529

    IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Critical 9.8
    CVE-2026-14446

    IBM WebSphere Application Server is affected by a privilege escalation

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2026-14512

    IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

    IBM WebSphere Application Server
  • Critical 9.3
    CVE-2026-11708

    IBM WebSphere Application Server is affected by a cross-site scripting vulnerability

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

    IBM WebSphere Application Server
  • Critical 9.3
    CVE-2026-11712

    IBM WebSphere Application Server is affected by a cross-site scripting vulnerability

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.

    IBM WebSphere Application Server
  • Critical 9.0
    CVE-2026-9319

    IBM WebSphere Application Server is affected by a remote code execution vulnerability

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

    IBM WebSphere Application Server
  • Critical 9.0
    CVE-2026-9311

    IBM WebSphere Application Server is affected by remote code execution

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

    IBM WebSphere Application Server
  • Critical 9.1
    CVE-2026-8644

    IBM WebSphere Application Server is affected by an identity spoofing vulnerability

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

    IBM WebSphere Application Server
  • Critical 9.0
    CVE-2025-36038 EPSS 13%

    IBM WebSphere Application Server code execution

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2020-4450 EPSS 35%

    IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the…

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2020-4448 EPSS 13%

    IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arb…

    IBM WebSphere Application Server
  • Critical 9.0
    CVE-2019-4279 Public exploit EPSS 80%

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with…

    IBM WebSphere Application Server
  • Critical 9.8
    CVE-2018-1567

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thr…

    IBM WebSphere Application Server