CVE-20XX-?

IBM Websphere Application Server CVEs.

Published CVEs affecting IBM Websphere Application Server, ranked by exploit odds.

77 CVEs · updated 2026-11-06 01:30 UTC

  1. CVE-2025-36038

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

    IBM Websphere Application Server

    9.0 CRITICAL 13% exploit odds Fix listed
  2. CVE-2026-14512

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

    IBM Websphere Application Server

    9.8 CRITICAL 1.0% exploit odds Fix listed
  3. CVE-2026-8633

    IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.

    IBM Websphere Application Server

    9.8 CRITICAL 0.9% exploit odds Fix listed
  4. CVE-2026-11595

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.

    IBM Websphere Application Server

    4.3 MEDIUM 0.8% exploit odds Fix listed
  5. CVE-2026-9336

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

    Auth & access Server IBM Websphere Application Server

    6.5 MEDIUM 0.8% exploit odds Fix listed
  6. CVE-2026-14974

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

    IBM Websphere Application Server

    8.1 HIGH 0.7% exploit odds Fix listed
  7. CVE-2026-9071

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    IBM Websphere Application Server

    7.5 HIGH 0.6% exploit odds Fix listed
  8. CVE-2026-14976

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

    IBM Websphere Application Server

    7.1 HIGH 0.6% exploit odds Fix listed
  9. CVE-2026-10571

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

    Code execution Server IBM Websphere Application Server

    5.7 MEDIUM 0.6% exploit odds Fix listed
  10. CVE-2026-8646

    IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

    IBM Websphere Application Server

    7.4 HIGH 0.6% exploit odds Fix listed
  11. CVE-2026-11536

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

    IBM Websphere Application Server

    8.5 HIGH 0.6% exploit odds Fix listed
  12. CVE-2025-14915

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.

    IBM Websphere Application Server

    6.5 MEDIUM 0.6% exploit odds Fix listed
  13. CVE-2026-9320

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    IBM Websphere Application Server

    5.9 MEDIUM 0.6% exploit odds Fix listed
  14. CVE-2026-9322

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

    IBM Websphere Application Server

    7.5 HIGH 0.6% exploit odds Fix listed
  15. CVE-2026-14525

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

    Auth & access Server IBM Websphere Application Server

    9.4 CRITICAL 0.5% exploit odds Fix listed
  16. CVE-2026-11897

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  17. CVE-2026-10842

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  18. CVE-2026-14529

    IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

    IBM Websphere Application Server

    9.4 CRITICAL 0.5% exploit odds Fix listed
  19. CVE-2026-14446

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

    IBM Websphere Application Server

    9.8 CRITICAL 0.5% exploit odds Fix listed
  20. CVE-2026-9330

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

    IBM Websphere Application Server

    8.5 HIGH 0.5% exploit odds Fix listed
  21. CVE-2026-9311

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

    IBM Websphere Application Server

    9.0 CRITICAL 0.5% exploit odds Fix listed
  22. CVE-2026-15280

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  23. CVE-2025-36047

    IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    IBM Websphere Application Server

    5.3 MEDIUM 0.5% exploit odds Fix listed
  24. CVE-2026-4410

    IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    IBM Websphere Application Server

    4.8 MEDIUM 0.5% exploit odds Fix listed
  25. CVE-2025-36097

    IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  26. CVE-2026-9338

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.

    Denial of service Server IBM Websphere Application Server

    5.3 MEDIUM 0.5% exploit odds Fix listed
  27. CVE-2026-8400

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

    Other Library IBM Websphere Application Server

    8.1 HIGH 0.5% exploit odds Fix listed
  28. CVE-2026-16184

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

    IBM Websphere Application Server

    7.0 HIGH 0.5% exploit odds Fix listed
  29. CVE-2026-11806

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

    IBM Websphere Application Server

    7.2 HIGH 0.5% exploit odds Fix listed
  30. CVE-2025-14914

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

    IBM Websphere Application Server

    7.6 HIGH 0.5% exploit odds Fix listed
  31. CVE-2024-56339

    IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.

    IBM Websphere Application Server

    3.7 LOW 0.5% exploit odds Fix listed
  32. CVE-2026-10845

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

    IBM Websphere Application Server

    7.3 HIGH 0.5% exploit odds Fix listed
  33. CVE-2026-14981

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  34. CVE-2026-15057

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

    IBM Websphere Application Server

    7.5 HIGH 0.5% exploit odds Fix listed
  35. CVE-2026-9319

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

    IBM Websphere Application Server

    9.0 CRITICAL 0.5% exploit odds Fix listed
  36. CVE-2026-14528

    IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

    IBM Websphere Application Server

    7.4 HIGH 0.5% exploit odds Fix listed
  37. CVE-2025-36124

    IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration

    IBM Websphere Application Server

    5.9 MEDIUM 0.4% exploit odds Fix listed
  38. CVE-2026-14980

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

    IBM Websphere Application Server

    8.3 HIGH 0.4% exploit odds Fix listed
  39. CVE-2026-9667

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

    Disclosure Server IBM Websphere Application Server

    5.3 MEDIUM 0.4% exploit odds Fix listed
  40. CVE-2026-18499

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

    Auth & access Server IBM Websphere Application Server

    8.1 HIGH 0.4% exploit odds Fix listed
  41. CVE-2025-14917

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.

    IBM Websphere Application Server

    6.7 MEDIUM 0.4% exploit odds Fix listed
  42. CVE-2026-11541

    IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

    IBM Websphere Application Server

    7.4 HIGH 0.4% exploit odds No fix listed
  43. CVE-2026-11546

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

    IBM Websphere Application Server

    7.1 HIGH 0.4% exploit odds Fix listed
  44. CVE-2026-93895

    IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

    Auth & access Server IBM Websphere Application Server

    9.1 CRITICAL 0.4% exploit odds Fix listed
  45. CVE-2026-15328

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

    IBM Websphere Application Server

    7.4 HIGH 0.4% exploit odds Fix listed
  46. CVE-2026-9006

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

    IBM Websphere Application Server

    7.4 HIGH 0.4% exploit odds Fix listed
  47. CVE-2026-11707

    IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

    IBM Websphere Application Server

    9.3 CRITICAL 0.4% exploit odds Fix listed
  48. CVE-2026-11708

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

    IBM Websphere Application Server

    9.3 CRITICAL 0.4% exploit odds Fix listed
  49. CVE-2026-11712

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.

    IBM Websphere Application Server

    9.3 CRITICAL 0.4% exploit odds Fix listed
  50. CVE-2026-16192

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

    IBM Websphere Application Server

    7.1 HIGH 0.4% exploit odds Fix listed

All CVEs affecting IBM Websphere Application Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.