CVE-2026-101294: CWE-325 Missing Cryptographic Step in IBM WebSphere Application Server - Liberty

This vulnerability (CVE-2026-101294) in IBM WebSphere Application Server - Liberty and IBM WebSphere Application Server 8.5 and 9.0 arises from improper verification of cryptographic signatures, classified as CWE-325 (Missing Cryptographic Step). A remote attacker could exploit this flaw to bypass signature verification, potentially allowing unauthorized actions or data manipulation. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and scope change. Confidentiality and integrity impacts are high, while availability is not affected.

Successful exploitation allows remote attackers to bypass cryptographic signature verification, which can lead to unauthorized access or manipulation of data protected by these signatures. This compromises confidentiality and integrity of the affected systems. There is no known impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided in the input data, users should monitor IBM's security advisories for updates and apply any official fixes once available. Until then, consider restricting network access to affected systems and review cryptographic usage policies to mitigate risk.