CVE-20XX-?
agent?

IBM Websphere Application Server CVEs.

Published CVEs affecting IBM Websphere Application Server, ranked by exploit odds.

17 CVEs · updated 2026-11-14 14:01 UTC

Reset all
  1. CVE-2010-0425

    modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."

    Drop everything Code execution OS & kernel IBM Websphere Application Server

    10.0 HIGH 94% exploit odds Fix listed
  2. CVE-2019-4279

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.

    Drop everything Code execution Server IBM Websphere Application Server

    9.8 CRITICAL 80% exploit odds Fix listed
  3. CVE-2020-4450

    IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231.

    Code execution Server IBM Websphere Application Server

    9.8 CRITICAL 35% exploit odds Fix listed
  4. CVE-2025-36038

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

    Code execution Server IBM Websphere Application Server

    9.0 CRITICAL 13% exploit odds Fix listed
  5. CVE-2020-4464

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.

    Code execution Web app IBM Websphere Application Server

    8.8 HIGH 13% exploit odds Fix listed
  6. CVE-2020-4448

    IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228.

    Code execution Web app IBM Websphere Application Server

    9.8 CRITICAL 13% exploit odds Fix listed
  7. CVE-2020-4589

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 184585.

    Code execution Server IBM Websphere Application Server

    9.8 CRITICAL 8% exploit odds Fix listed
  8. CVE-2000-0848

    Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header.

    Code execution Web app IBM Websphere Application Server

    10.0 HIGH 6% exploit odds Fix listed
  9. CVE-2018-1567

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024.

    Code execution Web app IBM Websphere Application Server

    9.8 CRITICAL 4% exploit odds Fix listed
  10. CVE-2024-35154

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.

    Code execution Server IBM Websphere Application Server

    7.2 HIGH 1% exploit odds Fix listed
  11. CVE-2026-14512

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

    Code execution Server IBM Websphere Application Server

    9.8 CRITICAL 1.0% exploit odds Fix listed
  12. CVE-2026-14974

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

    Code execution Server IBM Websphere Application Server

    8.1 HIGH 0.7% exploit odds Fix listed
  13. CVE-2026-10571

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

    Code execution Server IBM Websphere Application Server

    5.7 MEDIUM 0.6% exploit odds Fix listed
  14. CVE-2026-11536

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

    Code execution Server IBM Websphere Application Server

    8.5 HIGH 0.6% exploit odds Fix listed
  15. CVE-2026-9330

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

    Code execution Server IBM Websphere Application Server

    8.5 HIGH 0.5% exploit odds Fix listed
  16. CVE-2026-9319

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

    Code execution Server IBM Websphere Application Server

    9.0 CRITICAL 0.5% exploit odds Fix listed
  17. CVE-2026-93905

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

    Code execution Server IBM Websphere Application Server

    8.2 HIGH 0.3% exploit odds Fix listed

All CVEs affecting IBM Websphere Application Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.