CVE-20XX-?

IBM Websphere Application Server CVEs.

Published CVEs affecting IBM Websphere Application Server, ranked by exploit odds.

8 CVEs · updated 2026-11-06 10:11 UTC

Reset all
  1. CVE-2025-36038

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

    Code execution Server IBM Websphere Application Server

    9.0 CRITICAL 13% exploit odds Fix listed
  2. CVE-2026-14512

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

    Code execution Server IBM Websphere Application Server

    9.8 CRITICAL 1.0% exploit odds Fix listed
  3. CVE-2026-14974

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

    Code execution Server IBM Websphere Application Server

    8.1 HIGH 0.7% exploit odds Fix listed
  4. CVE-2026-10571

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

    Code execution Server IBM Websphere Application Server

    5.7 MEDIUM 0.6% exploit odds Fix listed
  5. CVE-2026-11536

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

    Code execution Server IBM Websphere Application Server

    8.5 HIGH 0.6% exploit odds Fix listed
  6. CVE-2026-9330

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

    Code execution Server IBM Websphere Application Server

    8.5 HIGH 0.5% exploit odds Fix listed
  7. CVE-2026-9319

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

    Code execution Server IBM Websphere Application Server

    9.0 CRITICAL 0.5% exploit odds Fix listed
  8. CVE-2026-93905

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

    Code execution Server IBM Websphere Application Server

    8.2 HIGH 0.3% exploit odds Fix listed

All CVEs affecting IBM Websphere Application Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.